24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan/PowerShell Sample ab7608bc7af2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab7608bc7af2…. Malware family: Trojan/PowerShell. Threat score 100/100. 1/24 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527","keywords":["Malicious","Trojan/PowerShell","malware analysis","sandbox report","threat intelligence","ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527"],"about":{"@type":"SoftwareApplication","name":"Runtime Broker.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan/PowerShell","antivirusDetections":{"malicious":1,"total":24},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T708,"RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\DOTNET\SETUP\INSTALLEDVERSIONS\X64"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "RuntimeBroker.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "")26:T68f,"RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E13C0D23-CCBC-4E12-931B-D9CC2EEE27E4"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "763FD754-7086-4DFE-95EB-C01A46FAF4CA"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "A669021C-C450-4609-A035-5AF59AF4DF18"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "RuntimeBroker.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")27:T72b,"RuntimeBroker.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "RuntimeBroker.exe" trying to touch file "C:\Windows\Temp\VxOle64.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\Temp\VxSSL64.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "RuntimeBroker.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "RuntimeBroker.exe" trying to touch file "C:\CRYPTBASE.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "RuntimeBroker.exe" trying to touch file "\Device\KsecDD" "RuntimeBroker.exe" trying to touch file "C:\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\system\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\ProgramData\Oracle\Java\javapath\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\System32\Wbem\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to touch file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-1.DLL" "RuntimeBroker.exe" trying to touch file "C:\Windows\system32\ext-ms-win-kernel32-package-current-l1-1-0.DLL" "RuntimeBroker.exe" trying to touch file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "RuntimeBroker.exe" trying to touch file "C:\RuntimeBroker.exe"28:T9b1,"RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\System32\Wbem\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\api-ms-win-core-windowserrorreporting-l1-1-0.dll" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-1.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system32\ext-ms-win-kernel32-package-current-l1-1-0.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-DATETIME-L1-1-1.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\API-MS-WIN-CORE-WINDOWSERRORREPORTING-L1-1-0.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-WINDOWSERRORREPORTING-L1-1-0.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\system\API-MS-WIN-CORE-WINDOWSERRORREPORTING-L1-1-0.DLL" "RuntimeBroker.exe" trying to access non-existent file "C:\Windows\API-MS-WIN-CORE-WINDOWSERRORREPORTING-L1-1-0.DLL"29:T8e1,Found PE header "MZ" - Source: "00000000-00004072.00000000.66746.22590000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000000.66746.22650000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22420000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22430000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.225B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22660000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22680000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22710000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22760000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.22780000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.45AF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.45B40000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.45B60000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.45BA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.45D10000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.45D20000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000002.70584.22440000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000002.70584.22460000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000002.70584.22600000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000002.70584.22630000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp")2a:Tec5,"out.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004072) "out.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004072) "out.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004072) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac960dfa7f0000000000000000000051edd60efa7f000000000000ad01000000000000000000008d50aed7db3000002a00000000000000206a4817ad0100008fecd60efa7f0000e0ac960dfa7f0000e0ac960dfa7f0000000000000000000000000000fa7f0000ffffff7f7e70000000000000000000000000000000000000d8ce8a0dfa7f00002a0000000000000069c3430dfa7f00003100000000000000c403000000000000c803000000000000110001100000000010d7c78b9d00000003a33e0cfa7f000010d7c78b9d00000000000000000000002b00000000000000000000000000000020b0490dfa7f0000b43f480dfa7f0000e0ce8a0d (UID: 00000000-00007280)2b:T14b2,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00007280) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300060000060c5a000060446645 (UID: 00000000-00003900) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300050000052fe2000020240f1a (UID: 00000000-00006568) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006356) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000650078006500000048004f004d004500440052004900560045003d0043003a00000048004f004d00450050004100540048003d005c00550073006500720073005c0058007a0034006a0079007700790000004c004f00430041004c0041005000500044004100540041003d0043003a005c00550073006500720073005c00 (UID: 00000000-00006092) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000046010000c0bccafd4601000000bdcafd460100000600000605c000001044c8fd (UID: 00000000-00000776) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630004000004087f000030535445 (UID: 00000000-00006056) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000e7020000f0c56632e702000030c66632e70200000500000527250000601d6532 (UID: 00000000-00003920) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000a7020000f0c54628a702000030c64628a702000005000005a9620000601d4528 (UID: 00000000-00007356) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006a007900770079005c0041007000700044006100740061005c0052006f0061006d0069006e006700000043006f006d006d006f006e00500072006f006700720061006d00460069006c00650073003d0043003a005c00500072006f006700720061006d002000460069006c00650073005c0043006f006d006d006f006e00 (UID: 00000000-00000580) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300040000044a870000108bf347 (UID: 00000000-00006088) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630004000004b0cd00003093f5b7 (UID: 00000000-00003404) "Runtime Broker.exe" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007208) "Runtime Broker.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007208)2c:T506,Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003900.00000000.67015.45660000.00000004.mdmp") Found reference to API "153863819793,7240,3024,,RtlGetVersion,NTDLL.dll,"00:18:26.718",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00003900.00000002.70858.45660000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp")2d:T748,"Runtime Broker.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Runtime Broker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T48b,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007280-00000C15-117230552 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00007280-00000C15-118573516 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007280-00000C15-121118854 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006092-00000C15-121723459 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006092-00000C15-123993749 "Runtime Broker.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\tor-data" at 00000000-00007208-00000C15-749812732f:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")30:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")31:T67d,"out.exe" called "CreateProcessW" with parameter ""powershell.exe" Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\S" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Applications\Runtime Broker.e" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\Windows\Applications\Runtime Broker.exe" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Dependencies\System Runtime M" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\Microsoft\WindowsApps\msedge.exe'" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" Add-MpPreference -ExclusionPath '%TEMP%\\Runtime Broker.exe'" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='C:\Users\%OSUSER%" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""powershell.exe" netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='C:\Users\Xz4jywy" - (UID: 00000000-00004072) "out.exe" called "CreateProcessW" with parameter ""%TEMP%\\Runtime Broker.exe" --SocksPort 9050 --DataDirectory %TEMP%\\to" - (UID: 00000000-00004072)32:T11b3d,"out.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter api-ms-win-core-windowserrorreporting-l1-1-0.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\en\mscorrc.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\mscorrc.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\ole32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\kernel32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\advapi32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\Shell32 (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter Shell32 (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\ntdll.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter icu.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\user32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\BCrypt.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter BCrypt.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter C:\ws2_32.dll (UID: 00000000-00004072) "out.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004072) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007280) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003900) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006568) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006092) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000776) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006056) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007356) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000580) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006088) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003404) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003404) "Runtime Broker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007208) "Runtime Broker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007208) "Runtime Broker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007208) "Runtime Broker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007208) "Runtime Broker.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007208)33:T79e8,Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000580.00000002.70910.759D0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000776.00000001.68967.FDC80000.00000004.mdmp, 00000000-00000776.00000002.70887.FDC80000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000776.00000001.68967.FDC80000.00000004.mdmp, 00000000-00000776.00000002.70887.FDC80000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00000776.00000001.68967.FDC80000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003404.00000001.69003.B7F40000.00000004.mdmp, 00000000-00003404.00000002.70923.B7F40000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003404.00000002.70923.B7F40000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003404.00000002.70923.B7F40000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003900.00000001.68935.45660000.00000004.mdmp, 00000000-00003900.00000002.70858.45660000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003900.00000001.68935.45660000.00000004.mdmp, 00000000-00003900.00000002.70858.45660000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003900.00000001.68935.45660000.00000004.mdmp, 00000000-00003900.00000002.70858.45660000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003920.00000000.67055.32640000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003920.00000001.68975.32640000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003920.00000001.68975.32640000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.22680000.00000002.mdmp, 00000000-00004072.00000001.68665.22710000.00000002.mdmp, 00000000-00004072.00000001.68665.45BA0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225D0000.00000002.mdmp, 00000000-00004072.00000001.68665.22780000.00000002.mdmp, 00000000-00004072.00000001.68665.45D10000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.45D60000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleBaseNameW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithLogonW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleFileNameExW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfoExW"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "FormatMessage"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225D0000.00000002.mdmp, 00000000-00004072.00000001.68665.22780000.00000002.mdmp, 00000000-00004072.00000001.68665.45D10000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.45D60000.00000002.mdmp") Found reference to API (Indicator: "GetMessage"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225D0000.00000002.mdmp, 00000000-00004072.00000001.68665.22780000.00000002.mdmp, 00000000-00004072.00000001.68665.45D10000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.45D60000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.22460000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetModuleBaseName"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "GetComputerName"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "K32GetModuleInformation"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.22790000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcessModules"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "K32EnumProcesses"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.22710000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupNames2"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "LsaClose"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeReturnBuffer"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "LsaNtStatusToWinError"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "LsaLookupSids"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "LsaOpenPolicy"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "LsaFreeMemory"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API (Indicator: "GetLength"; Source: "00000000-00004072.00000001.68665.22680000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004072.00000001.68665.22680000.00000002.mdmp, 00000000-00004072.00000002.70584.22460000.00000002.mdmp")34:T12ef,""powershell.exe" Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\S" (Indicator: ""powershell.exe" add-mppreference -exclusionpath '%appdata%\microsoft\windows\start menu\programs\startup\s") in Source: 00000000-00004072-00000C41-7512820871 "Add-MpPreference -ExclusionPath '%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "add-mppreference -exclusionpath '%appdata%\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: powershell.exe "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe' enable=yes" (Indicator: "netsh advfirewall firewall add rule name='microsoft edge webengine' dir=in action=allow program='%appdata%\microsoft\windows\start menu\programs\startup\system runtime monitor.exe' enable=yes") in Source: powershell.exe "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "add-mppreference -exclusionpath 'c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "Added Windows Defender exception for: 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "added windows defender exception for: 'c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "2024-01-23 10:32:26 [INFO] [AntiDefender.DisableWindowsDefender] Added Windows Defender exception for: 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "2024-01-23 10:32:26 [info] [antidefender.disablewindowsdefender] added windows defender exception for: 'c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "program='C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "program='c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe' enable=yes" (Indicator: "netsh advfirewall firewall add rule name='microsoft edge webengine' dir=in action=allow program='c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe' enable=yes") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "Added Windows Firewall exception for: 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "added windows firewall exception for: 'c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp "2024-01-23 10:32:27 [INFO] [AntiDefender.DisableWindowsFirewall] Added Windows Firewall exception for: 'C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Runtime Monitor.exe'" (Indicator: "2024-01-23 10:32:27 [info] [antidefender.disablewindowsfirewall] added windows firewall exception for: 'c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\system runtime monitor.exe'") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00004072.00000000.66746.42EE0000.00000004.mdmp 00000000-00004072.00000001.68665.42F11000.00000004.mdmp 00000000-00004072.00000002.70584.42F11000.00000004.mdmp35:Tca9,"out.exe" failed to load missing module "C:\ole32.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\kernel32.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\advapi32.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\Shell32" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\ntdll.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "icu.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\user32.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\BCrypt.dll" - [base:0; Status:c0000135] "out.exe" failed to load missing module "C:\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "Wtsapi32" - [base:ebd3bd50; Status:c0000135]36:T2524,"out.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base bd80000 "out.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base bd80000 "out.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base bd80000 "out.exe" loaded module "KERNEL32" at base c970000 "out.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base ecad0000 "out.exe" loaded module "KERNEL32.DLL" at base c970000 "out.exe" loaded module "NTDLL.DLL" at base ed20000 "out.exe" loaded module "NTDLL" at base ed20000 "out.exe" loaded module "API-MS-WIN-CORE-WINDOWSERRORREPORTING-L1-1-0.DLL" at base bd80000 "out.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base cad0000 "out.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base b0e0000 "out.exe" loaded module "C:\OLE32.DLL" at base 0 "out.exe" loaded module "OLE32.DLL" at base c820000 "out.exe" loaded module "C:\KERNEL32.DLL" at base 0 "out.exe" loaded module "C:\ADVAPI32.DLL" at base 0 "out.exe" loaded module "ADVAPI32.DLL" at base ca20000 "out.exe" loaded module "C:\SHELL32" at base 0 "out.exe" loaded module "SHELL32" at base d380000 "out.exe" loaded module "RPCRT4.DLL" at base cde0000 "out.exe" loaded module "SSPICLI.DLL" at base afa0000 "out.exe" loaded module "C:\NTDLL.DLL" at base 0 "out.exe" loaded module "ICU.DLL" at base 0 "out.exe" loaded module "C:\USER32.DLL" at base 0 "out.exe" loaded module "USER32.DLL" at base c4e0000 "out.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 9470000 "out.exe" loaded module "C:\BCRYPT.DLL" at base 0 "out.exe" loaded module "BCRYPT.DLL" at base ab70000 "out.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base b370000 "out.exe" loaded module "C:\WS2_32.DLL" at base 0 "out.exe" loaded module "WS2_32.DLL" at base c470000 "out.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base a8a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base bd80000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base bd80000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base bd80000 "powershell.exe" loaded module "KERNEL32" at base c970000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base ecad0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base ca20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base ec9b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base c300000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base b0e0000 "powershell.exe" loaded module "VERSION.DLL" at base 63c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base ebd80000 "powershell.exe" loaded module "USER32.DLL" at base c4e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base bd80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base eca60000 "powershell.exe" loaded module "NTDLL" at base ed20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base cad0000 "powershell.exe" loaded module "PSAPI.DLL" at base ece0000 "powershell.exe" loaded module "KERNEL32.DLL" at base c970000 "powershell.exe" loaded module "RPCRT4.DLL" at base cde0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base e2270000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base c820000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base cad0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base e7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base ead20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base e17f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base ec900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base a4b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base b370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base df780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base cad0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base cad0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base ed20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base d380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base ff040000 "powershell.exe" loaded module "WINTRUST.DLL" at base b310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 63c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base b310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base b120000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base faac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\3MGJ5Z13.DLL" at base fe580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base fe4e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base ea350000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base ea1e0000 "powershell.exe" loaded module "CRYPT32.DLL" at base b120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base deed0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base de560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base e9940000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "USER32.DLL" at base 1a1e0000 "powershell.exe" loaded module "WTSAPI32" at base ebd3bd50 "Runtime Broker.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base bd80000 "Runtime Broker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base bd80000 "Runtime Broker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base bd80000 "Runtime Broker.exe" loaded module "KERNEL32" at base c970000 "Runtime Broker.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base ecad0000 "Runtime Broker.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base a4b0000 "Runtime Broker.exe" loaded module "KERNEL32.DLL" at base c970000 "Runtime Broker.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base bd80000 "Runtime Broker.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base c970000 "Runtime Broker.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 96b0000 "Runtime Broker.exe" loaded module "NTDLL.DLL" at base ed20000 "Runtime Broker.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 5560000 "Runtime Broker.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base a8a0000 "Runtime Broker.exe" loaded module "RPCRT4.DLL" at base cde000037:Tfc0,Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00004072-00000C25-59440715] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007280-00000C25-65726755] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007280-00000C25-75026274] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007280-00000C25-76834045] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007280-00000C25-79270217] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007280-00000C25-81881705] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007280-00000C25-83728968] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007280-00000C25-85239868] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007280-00000C25-86648895] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007280-00000C25-88089689] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007280-00000C25-88889504] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007280-00000C25-91331871] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007280-00000C25-98506226] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007280-00000C25-102274416] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007280-00000C25-105707214] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007280-00000C25-105872985] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007280-00000C25-106187006] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007280-00000C25-106236156] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007280-00000C25-106582041] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007280-00000C25-109211264] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007280-00000C25-109247921] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007280-00000C25-112471488] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007280-00000C25-114424130] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00007280-00000C25-115965677] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00007280-00000C25-117733811]38:T762,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\ ..." (UID: 00000000-00007280) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\ ..." (UID: 00000000-00003900) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\Wind ..." (UID: 00000000-00006568) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\ ..." (UID: 00000000-00006356) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\Wind ..." (UID: 00000000-00006092) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%TEMP%\\\\Runtime Broker.exe'" (UID: 00000000-00000776) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00006056) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00003920) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00007356) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00000580) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00006088) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00003404) Spawned process "Runtime Broker.exe" with commandline "--SocksPort 9050 --DataDirectory %TEMP%\\\\tor-data" (UID: 00000000-00007208)39:T762,Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\ ..." (UID: 00000000-00007280) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\ ..." (UID: 00000000-00003900) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\Wind ..." (UID: 00000000-00006568) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\ ..." (UID: 00000000-00006356) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\Wind ..." (UID: 00000000-00006092) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%TEMP%\\\\Runtime Broker.exe'" (UID: 00000000-00000776) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00006056) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00003920) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00007356) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00000580) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00006088) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngi ..." (UID: 00000000-00003404) Spawned process "Runtime Broker.exe" with commandline "--SocksPort 9050 --DataDirectory %TEMP%\\\\tor-data" (UID: 00000000-00007208)3a:Tb039,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004072.00000000.66746.20A80000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000000.66746.22590000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000000.66746.22590000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000000.66746.22650000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000000.66746.22650000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000000.66746.22650000.00000002.mdmp") Found URL "http://n34kr3z26f3jzp4ckmwuv5ipqyatumdxhgjgsmucc65jac56khdy5zqd.onion0aa5b6ca-7bc9-4c5d-b58b-a317ac88a507program.startchecked" - Source: "00000000-00004072.00000000.66746.227C0000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004072.00000001.68665.20A80000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.22420000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00004072.00000001.68665.22420000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004072.00000001.68665.22420000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000001.68665.22420000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.22430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000001.68665.22430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000001.68665.22430000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.225B0000.00000002.mdmp") Found URL "https://aka.ms/binaryformatter" - Source: "00000000-00004072.00000001.68665.225B0000.00000002.mdmp") Found URL "https://aka.ms/dotnet-warnings/" - Source: "00000000-00004072.00000001.68665.225B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000001.68665.225B0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000001.68665.225B0000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1416." - Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1906." - Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.225D0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.22660000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000001.68665.22660000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.22680000.00000002.mdmp") Found URL "https://aka.ms/dotnetquicoperation" - Source: "00000000-00004072.00000001.68665.22680000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.22680000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.22710000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.22710000.00000002.mdmp") Found URL "https://aka.ms/dotnet-illink/com)$00000001-0000-0000-c000-000000000046[native" - Source: "00000000-00004072.00000001.68665.22760000.00000002.mdmp") Found URL "https://aka.ms/dotnet-illink/nativehost$b196b28f-bab4-101a-b69c-00aa00341d07wrapnonexceptionthrowsserviceabletrue.netframeworkassemblyistrimmabletrueen-us.netcoreapp,version=v6.0frameworkdisplaynamemicrosoft" - Source: "00000000-00004072.00000001.68665.22760000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.22760000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.22760000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.22780000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000001.68665.22780000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.45AF0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000001.68665.45AF0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.45AF0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.45BA0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000001.68665.45BA0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.45BA0000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000001.68665.45D10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.45D10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000001.68665.45D20000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000001.68665.45D20000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0zf;8>=:" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@wo)" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0bz-q8hkhuqim(" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation" - Source: "00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004072.00000002.70584.20A80000.00000004.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000002.70584.22440000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000002.70584.22440000.00000002.mdmp") Found URL "https://gitlab.com/syroot/knownfolders$008ca0b1-55b4-4c56-b8a8-4de4b299d3be$724ef170-a42d-4fef-9f26-b60e846fba4f$b2c5e279-7add-439f-b28c-c41fe1bbf672$7be16610-1f7f-44ac-bff0-83e15f2ffca1$7cfbefbc-de1f-45aa-b843-a542ac536cc9$559d40a3-a036-40fa-af61-84cb430a4d34$a3918781-e5f2-4890-b3d9-a7e54332328c$ab5fb87b-7ce2-4f83-915d-550846c9537b$9e52ab10-f80d-49df-acb8-4330f5687855$d0384e7d-bac3-4797-8f14-cba229b392b5$c1bae2d0-10df-4334-bedd-7aa20b227a9d$0139d44e-6afe-49f2-8690-3dafcae6ffb8$a4115719-d62e-491d-aa7c-e74b8be3b067$82a5ea35-d9cd-47c5-9629-e15d2f714e6e$b94237e7-57ac-4347-9151-b08c6c32d1f7$56784854-c6cb-462b-8169-88e350acb882$2b0f765d-c0e9-4171-908e-08a611b84ff6$b4bfcc3a-db2c-424c-b029-7fe99a87c641$5ce4a5e9-e4eb-479d-b89f-130c02886155$fdd39ad0-238f-46af-adb4-6c85480369c7$7b0db17d-9cd2-4a93-9733-46cc89022e7c$f42ee2d3-909f-4907-8871-4c22fc0bf756$374de290-123f-4565-9164-39c4925e467b$7d83ee9b-2244-4e70-b1f5-5393042af1e4$1777f761-68ad-4d8a-87bd-30b759fa33dd$fd228cb7-ae11-4ae3-864c-16f3910ab8fe$054fae61-4dd8-4787-80b6-090220c4b700$d9dc8a3b-b784-432e-a781-5a1130a75963$bcb5256f-79f6-4cee-b725-dc34e402fd46$352481e8-33be-4251-ba85-6007caedcf9d$1b3ea5dc-b587-4786-b4ef-bd1dc332aeae$bfb9d5e0-c6a9-404c-b2b2-ae6db6af4968$f1b32785-6fba-4fcf-9d55-7b8e7f157091$a520a1a4-1780-4ff6-bd18-167343c5af16$2a00375e-224c-49de-b8d1-440df7ef3ddc$4bd8d571-6d19-48d3-be97-422220080e43$2112ab0a-c86a-4ffe-a368-0de96e47012e$a0c69a99-21c8-4671-8703-7934162fcf1d$c5abbf53-e17f-4121-8900-86626fc2c973$31c0dd25-9439-4f12-bf41-7ff4eda38722$2c36c0aa-5812-4b87-bfd0-4cd0dfb19b39$69d2cf90-fc33-4fb7-9a0c-ebb0f0fcb43c$a990ae9f-a03b-4e80-94bc-9912d7504104$33e28130-4e1e-4676-835a-98395c3bc3bb$0ddd015d-b06c-45d5-8c4c-f59713854639$de92c1c7-837f-4f69-a3bb-86e631204a23$9274bd8d-cfd1-41c3-b35e-b13f55a758f4$5e6c858f-0e22-4760-9afe-ea3317b67173$62ab5d82-fdc1-4dc3-a9dd-070d1d495d97$905e63b6-c1bf-494e-b29c-65b732d3d21a$6d809377-6af0-444b-8957-a3773f02200e$7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e$f7f1ed05-9f6d-47a2-aaae-29d317c6f066$6365d5a7-0f0d-45e5-87f6-0da56b6a4f7d$de974d24-d9c6-4d3e-bf91-f4455120b917$a77f5d77-2e2b-44c3-a6a2-aba601054a51$dfdf76a2-c82a-4d63-906a-5644ac457385$c4aa340d-f20f-4863-afef-f87ef2e6ba25$ed4824af-dce4-45a8-81e2-fc7965083634$3d644c9b-1fb8-4f30-9b45-f670235f79c0$debf2536-e1a8-4c59-b6a2-414586476aea$48daf80b-e6cf-4f4e-b800-0e69d84ee384$3214fab5-9757-4298-bb61-92a9deaa44ff$b6ebfb86-6907-413c-9af7-4fc2abf07cc5$e555ab60-153b-4d17-9f04-a5fe99fc15ec$0482af6c-08f1-4c34-8c90-e17ec98b1e17$2400183a-6185-49fb-a2d8-4a392a602ba3$52a4f021-7b75-48a9-9f6b-4b87a210bc8f$ae50c081-ebd2-438a-8655-8a092e34987a$1a6fdba2-f42d-4358-a798-b74d745926c5$8ad10c31-2adb-4296-a8f7-e4701232c972$c870044b-f49e-4126-a9c3-b52a1ff411e8$3eb685db-65f9-4cf6-a03a-e3ef65729f3d$aaa8d5a5-f1d6-4259-baa8-78e7ef60835e$00bcfc5a-ed94-4e48-96a1-3f6217f21990$b250c668-f57d-4ee1-a63c-290ee7d1aa1f$c4900540-2379-4c75-844b-64e6faf8716b$15ca69b3-30ee-49c1-ace1-6b5ec372afb5$859ead94-2e85-48ad-a71a-0969cb56a6cd$4c5c32ff-bb9d-43b0-b5b4-2d72e54eaaa4$7d1d3a04-debb-4115-95cf-2f29da2920da$b7bede81-df94-4682-a7d8-57a52620b86f$0d4c3db6-03a3-462f-a0e6-08924c41b5d4$7e636bfe-dfa9-4d5e-b456-d7b39851d8a9$8983036c-27c0-404b-8f08-102d10dcfd74$7b396e54-9ec5-4300-be0a-2482ebae1a26$a75d362e-50fc-4fb7-ac2c-a8beaa314493$a52bba46-e9e1-435f-b3d9-28daa648c0f6$767e6811-49cb-4273-87c2-20f355e1085b$24d89e24-2f19-4534-9dde-6a6671fbb8fe$339719b5-8c47-4894-94c2-d8f77add44a6$625b53c3-ab48-4ec1-ba1f-a1ef4146fc19$b97d20bb-f46a-4c97-ba10-5e3608430854$1ac14e77-02e7-4e5d-b744-2eb1ae5198b7$d65231b0-b2f1-4857-a4ce-a8e7c6ea7d27$a63293e8-664e-48db-a079-df759e0509f7$9e3995ab-1f9c-4f13-b827-48b24b6c7174$0762d272-c50a-4bb0-a382-697dcd729b80$5cd7aee2-2219-4a67-b85d-6c9ce15660cb$bcbd3057-ca5c-4622-b42d-bc56db0ae516$18989b1d-99b5-455b-841c-ab7c74e4ddfc$491e922f-5643-4af4-a7eb-4e7a138d8174$35286a68-3c57-41a1-bbb1-0eae73d76c95$f38bf404-1d43-42f2-9305-67de0b28fc23allowmultiple" - Source: "00000000-00004072.00000002.70584.22460000.00000002.mdmp") Found URL "https://github.com/mono/linker/pull/2125.vcreating" - Source: "00000000-00004072.00000002.70584.22600000.00000002.mdmp") Found URL "https://github.com/mono/linker/pull/2125.reflectionanalysis$il2067:unrecognizedreflectionpatternjustificationxthe" - Source: "00000000-00004072.00000002.70584.22600000.00000002.mdmp") Found URL "https://github.com/mono/linker/pull/2125.reflectionanalysis$il2070:unrecognizedreflectionpatternjustification?the" - Source: "00000000-00004072.00000002.70584.22600000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000002.70584.22600000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000002.70584.22600000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000002.70584.22630000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime" - Source: "00000000-00004072.00000002.70584.22630000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0zf;8>=:" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@wo)" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "http://www.microsoft.com0" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20time-stamp%20pca%202010(1).crl0l" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/microsoft%20time-stamp%20pca%202010(1).crt0bz-q8hkhuqim(" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0>ngdxfg:smxsu$was.,k" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation" - Source: "00000000-00004072.00000002.70584.22730000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000002.70584.22750000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000002.70584.22750000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1731" - Source: "00000000-00004072.00000002.70584.22790000.00000002.mdmp") Found URL "https://github.com/mono/linker/issues/1895vreflectionanalysisil2057:typegettypejustification;using" - Source: "00000000-00004072.00000002.70584.22790000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000002.70584.22790000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000002.70584.22790000.00000002.mdmp") Found URL "https://github.com/jamesnk/newtonsoft.jsonen-us*newtonsoft.json.jsonreader+d__29newtonsoft.json.jsonreader+d__3d__6;newtonsoft.json.jsonreader+d__13bnewtonsoft.json.jsonreader+d__150newtonsoft.json.jsontextreader+d__38newtonsoft.json.jsontextreader+d__4:newtonsoft.json.jsontextreader+d__52newtonsoft.json.jsontextreader+d__74newtonsoft.json.jsontextreader+d__8>newtonsoft.json.jsontextreader+d__9@newtonsoft.json.jsontextreader+d__117newtonsoft.json.jsontextreader+d__124newtonsoft.json.jsontextreader+d__146newtonsoft.json.jsontextreader+d__157newtonsoft.json.jsontextreader+d__168newtonsoft.json.jsontextreader+d__176newtonsoft.json.jsontextreader+d__185newtonsoft.json.jsontextreader+d__19jnewtonsoft.json.jsontextreader+d__206newtonsoft.json.jsontextreader+d__21;newtonsoft.json.jsontextreader+d__259newtonsoft.json.jsontextreader+d__26fnewtonsoft.json.jsontextreader+d__27fnewtonsoft.json.jsontextreader+d__286newtonsoft.json.jsontextreader+d__298newtonsoft.json.jsontextreader+d__31?newtonsoft.json.jsontextreader+d__32@newtonsoft.json.jsontextreader+d__337newtonsoft.json.jsontextreader+d__345newtonsoft.json.jsontextreader+d__357newtonsoft.json.jsontextreader+d__36:newtonsoft.json.jsontextreader+d__37:newtonsoft.json.jsontextreader+d__38:newtonsoft.json.jsontextreader+d__408newtonsoft.json.jsontextreader+d__42dnewtonsoft.json.jsontextreader+d__43;newtonsoft.json.jsontextreader+d__45anewtonsoft.json.jsontextreader+d__47:newtonsoft.json.jsontextreader+d__499newtonsoft.json.jsontextreader+d__518newtonsoft.json.jsontextreader+d__539newtonsoft.json.jsontextreader+d__551newtonsoft.json.jsontextwriter+d__8>newtonsoft.json.jsontextwriter+d__96newtonsoft.json.jsontextwriter+d__13=newtonsoft.json.jsontextwriter+d__15d__24>newtonsoft.json.jsontextwriter+d__30>newtonsoft.json.jsontextwriter+d__32d__35=newtonsoft.json.jsontextwriter+d__38bnewtonsoft.json.jsontextwriter+d__40;newtonsoft.json.jsontextwriter+d__43d__547newtonsoft.json.jsontextwriter+d__607newtonsoft.json.jsontextwriter+d__647newtonsoft.json.jsontextwriter+d__787newtonsoft.json.jsontextwriter+d__977newtonsoft.json.jsontextwriter+d__99=newtonsoft.json.jsontextwriter+d__110:newtonsoft.json.jsontextwriter+d__115;newtonsoft.json.jsontextwriter+d__121enewtonsoft.json.jsonwriter+d__02newtonsoft.json.jsonwriter+d__29newtonsoft.json.jsonwriter+d__211newtonsoft.json.jsonwriter+d__31d__32;newtonsoft.json.jsonwriter+d__33jnewtonsoft.json.jsonwriter+<g__awaitproperty" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00004072.00000002.70584.45B10000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000002.70584.45B50000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000002.70584.45B70000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll!this" - Source: "00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime_cordllmainmscoree.dll" - Source: "00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000002.70584.45D30000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows!this" - Source: "00000000-00004072.00000002.70584.45D60000.00000002.mdmp") Found URL "https://github.com/dotnet/runtime!this" - Source: "00000000-00004072.00000002.70584.45D60000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=2233907" - Source: "00000000-00004072.00000002.70584.45D60000.00000002.mdmp") Found URL "https://github.com/dotnet/runtimewindows7.0windows" - Source: "00000000-00004072.00000002.70584.45D60000.00000002.mdmp") Found URL "http://.ni.dll.ni.exesystem.private.corelib.dllsystem.private.corelibneutralrequested" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/runtimes-sdk-infolearn" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet-downloadhost-options:" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failedto" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet-downloadlearn" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/sdk-not-foundfailed" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet-core-applaunch?description:" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://aka.ms/dotnet/app-launch-failed&gui=truebundle" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://mathematicsmargin-top:eventually" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://descriptionrelatively" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://applicationslink" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://navigation" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://px;" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://www.world" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://www.years" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://interested" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://familiar" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://was" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "https://ain" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://whether" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://interpreted" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://);" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://addeventlistenerresponsible" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://.jpg" - Source: "00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found URL "http://9iqmgvw,czcthawte," - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?edigicert" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?il" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://crl).crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt00$[c>zxn^oyd@e[washington1redmond1microsoration1200)microsoft" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microocepya'4iy()>@6t+a6" - Source: "00000000-00006092.00000002.70883.D3A30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007280.00000002.70793.173D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007280.00000002.70793.173D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007280.00000002.70793.173D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007280.00000002.70793.174F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007280.00000002.70793.174F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007280.00000002.70793.174F0000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007280.00000002.70793.19300000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czcp@e1o!yj>9iqmgvw,czcp@e1decddecdglobalsign" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e@'e1@'e10be1@'e1decdp3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1pmg1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1p3e1" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0120531151137z0/^g(o-cejy" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?pqn1rszyszvonde1+0)" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=517145" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>y" - Source: "00000000-00007280.00000002.70793.31640000.00000004.mdmp")3b:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007280) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007280) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007280)3c:T9e8,Found reference to API "149770781003,5152,3115,,CreateToolhelp32Snapshot,kernel32.dll,"00:18:26.937",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000580.00000002.70910.759D0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003920.00000002.70893.C278A000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API "K32EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API "EnumProcessModulesUntilSuccess" (Indicator: "EnumProcessModules"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API "GetCurrentProcessToken" (Indicator: "GetCurrentProcess"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp")3d:T56c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API "LsaGetLogonSessionData" (Indicator: "LsaGetLogonSessionData"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp")3e:T8e7,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000580.00000001.68991.759D0000.00000004.mdmp, 00000000-00000580.00000002.70910.759D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000580.00000002.70910.759D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00000776.00000001.68967.FDC80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000776.00000002.70887.FDC80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00003404.00000001.69003.B7F40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003404.00000002.70923.B7F40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003900.00000001.68935.45660000.00000004.mdmp, 00000000-00003900.00000002.70858.45660000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003900.00000002.70858.45660000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003920.00000001.68975.32640000.00000004.mdmp, 00000000-00003920.00000002.70893.32640000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004072.00000000.66746.20A80000.00000004.mdmp, 00000000-00004072.00000001.68665.20A80000.00000004.mdmp, 00000000-00004072.00000002.70584.20A80000.00000004.mdmp") Found string "\Device\HarddiskVolume2\out.exe" (Indicator: "\Device\"; Source: "00000000-00004072.00000000.66746.20A80000.00000004.mdmp, 00000000-00004072.00000001.68665.20A80000.00000004.mdmp, 00000000-00004072.00000002.70584.20A80000.00000004.mdmp")3f:T938,"out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\RUNTIME BROKER.EXE"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "out.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")40:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")41:Tcc6,"out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 872) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 872) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 924) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 924) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 916) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 916) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 912) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 912) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 900) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 900) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 932) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 932) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 948) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 948) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 968) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 968) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 956) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 956) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 960) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 960) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 964) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 964) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 944) "out.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 944) "out.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Runtime Broker.exe" (Handle: 984) "out.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Runtime Broker.exe" (Handle: 984)42:Taa6,Spawned process "out.exe" (UID: 00000000-00004072) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe'" (UID: 00000000-00007280) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe'" (UID: 00000000-00003900) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe'" (UID: 00000000-00006568) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe'" (UID: 00000000-00006356) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe'" (UID: 00000000-00006092) Spawned process "powershell.exe" with commandline "Add-MpPreference -ExclusionPath '%TEMP%\\\\Runtime Broker.exe'" (UID: 00000000-00000776) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe' enable=yes" (UID: 00000000-00006056) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe' enable=yes" (UID: 00000000-00003920) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe' enable=yes" (UID: 00000000-00007356) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe' enable=yes" (UID: 00000000-00000580) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe' enable=yes" (UID: 00000000-00006088) Spawned process "powershell.exe" with commandline "netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%TEMP%\\\\Runtime Broker.exe' enable=yes" (UID: 00000000-00003404) Spawned process "Runtime Broker.exe" with commandline "--SocksPort 9050 --DataDirectory %TEMP%\\\\tor-data" (UID: 00000000-00007208)43:T4285,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCAKi/54AHWcDKN7MMgzW+Je4GnjudtlwpnXzX+Iejz1QKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004200a8bfe7800759c0ca37b30c8335be25ee069e3b9db65c299d7cd7f887a3cf540a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EFDodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAKc/" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlqAYJKoZIhvcNAQcCoIIlmTCCJZUCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13262" "dwFlags": "1" "pbBinary": "308225a806092a864886f70d010702a082259930822595020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d0609608648016503040201050004208218ab9b4449e05791050e874ae5bad302a9646951dabff33e4a4a865aa14a2aa0820b62308204ef308203d7a00302010202133300000a73f154098656107847000000000a73300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034345a170d3234303133313139303034345a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100b4ce74c0cad1188cdf8838138bcd067e336adbab396df6edbff6c9c16fd5f86077fa4301be71c2c88fcc329f4fa51cb6a0907c36910f619f29978492eff9f569325132362806c80987d2b33572bb10a144e819aab6526dbc3a1526f42471a861a5eabbe6675438e44c6f02aebf804d09524989c8fa511d9b8921d99c787d031340027828fd8ed86d76bb4db0308641c8efa99874b125e2bb0c57fe982f73c98710921faa12bde5d4eed02573eea92138233578f53c80e59b0b5ecd029b6a19ea6cd2fe5e7c4132ad8bf3c5e7b9d9f50eed1da2b7c26d5c3b89d6bf57ed30cb04f9528f865e8d6312f597a5bc64abbfdf14c89cda8a789a43cd71006c51fbe05d0203010001a382017730820173301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414ad470300e97fa66722d1a34941c284c5a321ce6430540603551d11044d304ba4493047312d302b060355040b13244d6963726f736f6674204972656c616e64204f7065726174696f6e73204c696d69746564311630140603550405130d3233303032382b353030313931301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c" "pcbBinary": "ac250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCuweDGBKLLkpvRIfNHqlHxBvX6u7A8kK+C53oBAy+VdKCCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIlmgYJKoZIhvcNAQcCoIIlizCCJYcCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259a06092a864886f70d010702a082258b30822587020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420aec1e0c604a2cb929bd121f347aa51f106f5fabbb03c90af82e77a01032f9574a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9e250000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIlmQYJKoZIhvcNAQcCoIIlijCCJYYCAQExDzANBglghkgBZQMEAgEFADB5BgorBgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLGKX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD1Ic9VXSKRHe3vJHTviA7n2oanD+d84ekkYUUIWGAvN6CCC1MwggTgMIIDyKADAgECAhMzAAAKdX" "cchString": "13242" "dwFlags": "1" "pbBinary": "3082259906092a864886f70d010702a082258a30822586020101310f300d060960864801650304020105003079060a2b060104018237020104a06b30693034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003031300d060960864801650304020105000420f521cf555d22911dedef2474ef880ee7da86a70fe77ce1e92461450858602f37a0820b53308204e0308203c8a00302010202133300000a757deb19b9225df12b000000000a75300d06092a864886f70d01010b05003079310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312330210603550403131a4d6963726f736f66742057696e646f7773205043412032303130301e170d3233303231363139303034365a170d3234303133313139303034365a3070310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e311a3018060355040313114d6963726f736f66742057696e646f777330820122300d06092a864886f70d01010105000382010f003082010a0282010100a6f16b323d2045121cf15652015f37fba09f3421ef146367e03c4e3411f7bdedf9fb98ca373f2af8cd6bf8077986e6d7ccb5ae9f50bc02e05b8da60107067b4f5cea72087a495d822081f7f660e9652ad74fe233e2d24b9e0ef8a6ffeba10551d5bd04c97ee1b51e11bab4043d4ecdbe42dacc314caf2ee453d4cb7a740369f57276765b213c047420ccaf56bfc1e54c6bbec0418c677d9f054974668c384717e06635252d1657e99dfaf293799061fa4025f15736d69d85913aa682a9414802c0859bd6822b1a45244841cdf7d0429e4eea8cf08b2ba67fb9b10f24841cc06a298e16d62ed43be7634ab666f08270872bdd3dfdbb2ab5e0df3ccda977d300ad0203010001a382016830820164301f0603551d2504183016060a2b0601040182370a030606082b06010505070303301d0603551d0e04160414be25173e2b251eea46eaac3ee812e47402198e0a30450603551d11043e303ca43a3038311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e311630140603550405130d3233303032382b353030313839301f0603551d23041830168014d14fa98a0708cef4241898e500fff3d6791d37bc30530603551d1f044c304a3048a046a0448642687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d69635769" "pcbBinary": "9d250000" "pdwFlags": "01000000"}44:T1587,Assembly shows XOR instruction xor esi dword ptr [181D3080h] in Stream UID: 26203-37-18133471 Assembly shows XOR instruction xor eax esi in Stream UID: 26203-102-1812F180 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-86-1815234B Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-86-1815234B Assembly shows XOR instruction xor esi dword ptr [181D31D8h] in Stream UID: 26203-67-18140234 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-83-18152994 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-83-18152994 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-85-181528AB Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-85-181528AB Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-122-1814B992 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-122-1814B992 Assembly shows XOR instruction xor edx eax in Stream UID: 26203-18-18146A3D Assembly shows XOR instruction xor edi dword ptr [181CE00Ch] in Stream UID: 26203-18-18146A3D Assembly shows XOR instruction xor eax dword ptr [181CE00Ch] in Stream UID: 26203-19-1813330A Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-104-1814A43B Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-104-1814A43B Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 26203-61-1811B8C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-61-1811B8C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-81-181527D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-81-181527D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-109-1814BA95 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-109-1814BA95 Assembly shows XOR instruction xor eax ebp in Stream UID: 26203-107-1814A0A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26203-107-1814A0A1 Assembly shows XOR instruction xor rbx qword ptr [00000001800503F0h] in Stream UID: 27680-96-000000018001AFF4 Assembly shows XOR instruction xor ebx dword ptr [00000001800503F0h] in Stream UID: 27680-96-000000018001AFF4 Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-71-000000018002423C Assembly shows XOR instruction xor eax esp in Stream UID: 27680-71-000000018002423C Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-71-000000018002423C Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-71-000000018002423C Assembly shows XOR instruction xor rbx qword ptr [0000000180050578h] in Stream UID: 27680-54-000000018001C3DC Assembly shows XOR instruction xor ebx dword ptr [0000000180050578h] in Stream UID: 27680-54-000000018001C3DC Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-72-0000000180023C4C Assembly shows XOR instruction xor eax esp in Stream UID: 27680-72-0000000180023C4C Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-72-0000000180023C4C Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-72-0000000180023C4C Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-82-000000018001FC68 Assembly shows XOR instruction xor eax esp in Stream UID: 27680-82-000000018001FC68 Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-82-000000018001FC68 Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-82-000000018001FC68 Assembly shows XOR instruction xor rax rbp in Stream UID: 27680-93-0000000180020D6C Assembly shows XOR instruction xor eax ebp in Stream UID: 27680-93-0000000180020D6C Assembly shows XOR instruction xor rcx rbp in Stream UID: 27680-93-0000000180020D6C Assembly shows XOR instruction xor ecx ebp in Stream UID: 27680-93-0000000180020D6C Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-84-000000018001F790 Assembly shows XOR instruction xor eax esp in Stream UID: 27680-84-000000018001F790 Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-84-000000018001F790 Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-84-000000018001F790 Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-66-0000000180024138 Assembly shows XOR instruction xor eax esp in Stream UID: 27680-66-0000000180024138 Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-66-0000000180024138 Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-66-0000000180024138 Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-69-0000000180024358 Assembly shows XOR instruction xor eax esp in Stream UID: 27680-69-0000000180024358 Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-69-0000000180024358 Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-69-0000000180024358 Assembly shows XOR instruction xor rax rsp in Stream UID: 27680-29-00000001800186FC Assembly shows XOR instruction xor eax esp in Stream UID: 27680-29-00000001800186FC Assembly shows XOR instruction xor rcx rsp in Stream UID: 27680-29-00000001800186FC Assembly shows XOR instruction xor ecx esp in Stream UID: 27680-29-00000001800186FC Assembly shows XOR instruction xor rax rbp in Stream UID: 27680-86-0000000180023764 Assembly shows XOR instruction xor eax ebp in Stream UID: 27680-86-0000000180023764 Assembly shows XOR instruction xor rcx rbp in Stream UID: 27680-86-0000000180023764 Assembly shows XOR instruction xor ecx ebp in Stream UID: 27680-86-000000018002376445:T45a,"powershell.exe" queries volume information of "C:\" at 00000000-00003440-00000C15-91816401 "powershell.exe" queries volume information of "C:\" at 00000000-00004876-00000C15-89685230 "powershell.exe" queries volume information of "C:\" at 00000000-00001332-00000C15-92415350 "powershell.exe" queries volume information of "C:\" at 00000000-00005512-00000C15-93698475 "powershell.exe" queries volume information of "C:\" at 00000000-00005732-00000C15-92055522 "powershell.exe" queries volume information of "C:\" at 00000000-00008448-00000C15-92597490 "powershell.exe" queries volume information of "C:\" at 00000000-00008668-00000C15-92109266 "powershell.exe" queries volume information of "C:\" at 00000000-00004496-00000C15-92198221 "powershell.exe" queries volume information of "C:\" at 00000000-00006320-00000C15-92864167 "powershell.exe" queries volume information of "C:\" at 00000000-00008536-00000C15-87881913 "powershell.exe" queries volume information of "C:\" at 00000000-00006740-00000C15-92128833 "powershell.exe" queries volume information of "C:\" at 00000000-00008868-00000C15-9146414146:T4ba,"powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00003440) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00004876) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00001332) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00005512) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00005732) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00008448) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00008668) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00004496) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00006320) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00008536) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00006740) "powershell.exe" called "GetProcAddress" with a parameter "AmsiScanBuffer" (UID: 00000000-00008868)47:T59a,"msedgeupdate.dll" contains export function called "DllEntry" at ordinal 1 "psmachine_64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psmachine_64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psmachine_64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psmachine_64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psuser_64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psuser_64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psuser_64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psuser_64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psuser_arm64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psuser_arm64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psuser_arm64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psuser_arm64.dll" contains export function called "DllUnregisterServer" at ordinal 4 "psmachine_arm64.dll" contains export function called "DllCanUnloadNow" at ordinal 1 "psmachine_arm64.dll" contains export function called "DllGetClassObject" at ordinal 2 "psmachine_arm64.dll" contains export function called "DllRegisterServer" at ordinal 3 "psmachine_arm64.dll" contains export function called "DllUnregisterServer" at ordinal 448:T1101,"msedgeupdate.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msedgeupdate.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "psmachine_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psuser_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psuser_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psmachine_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psmachine_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psuser_64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psmachine_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psuser_arm64.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "psmachine.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "psuser.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "psmachine.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "psuser.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateComRegisterShell64.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MicrosoftEdgeUpdate.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateComRegisterShell64.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MicrosoftEdgeUpdate.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeComRegisterShellARM64.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MicrosoftEdgeComRegisterShellARM64.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT49:T421,"msedgeupdate.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine_64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser_64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser_arm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine_arm64.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psmachine.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "psuser.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateCore.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateComRegisterShell64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdate.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeComRegisterShellARM64.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateBroker.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "MicrosoftEdgeUpdateOnDemand.exe" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"4a:T36b5,"msedgeupdate.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1814e7f8,call 0x1814ee78,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1814e6b4,add esp, 0xc,pop ebp,ret 0xc,jmp 0x180e0560,push ebp,mov ebp, esp,jmp 0x1814e824,push dword ptr [ebp + 8],call 0x1816e18a,pop ecx,test eax, eax,je 0x1814e833,push dword ptr [ebp + 8],call 0x1816a372,pop ecx,test eax, eax,je 0x1814e817,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1814f043,jmp 0x1814f026,push ebp,mov ebp, esp,pop ebp,jmp 0x1814e812,push ebp,mov ebp, esp," "msedgeupdate.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1811b2de,call 0x1811b952,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1811b19a,add esp, 0xc,pop ebp,ret 0xc,jmp 0x1811aa43,push ebp,mov ebp, esp,jmp 0x1811b30a,push dword ptr [ebp + 8],call 0x18140207,pop ecx,test eax, eax,je 0x1811b319,push dword ptr [ebp + 8],call 0x18137112,pop ecx,test eax, eax,je 0x1811b2fd,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1811bb4a,jmp 0x1811bb2d,push ebp,mov ebp, esp,pop ebp,jmp 0x1811b2f8,push ebp,mov ebp, esp," "psmachine_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180017371,call 0x1800176d8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001721c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x1800173aa,mov rcx, rbx,call 0x18001fd98,test eax, eax,je 0x1800173ba,mov rcx, rbx,call 0x18001c454,test rax, rax,je 0x18001739b," "psuser_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180017371,call 0x1800176d8,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18001721c,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x1800173aa,mov rcx, rbx,call 0x18001fd98,test eax, eax,je 0x1800173ba,mov rcx, rbx,call 0x18001c454,test rax, rax,je 0x18001739b," "psuser_arm64.dll" file has an entrypoint instructions - "jg 0x8001abd5,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001ab7e,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,sub byte ptr [eax], al,add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001ac25,add edx, ebp," "psmachine_arm64.dll" file has an entrypoint instructions - "jg 0x8001abd5,add edx, ebp,push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001ab7e,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,sub byte ptr [eax], al,add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4],mov bh, bh,call dword ptr [edi - 0x573e8403],cmc ,or eax, dword ptr [eax - 7],push ebx,ret 0xffa8,and eax, dword ptr [ebx],aad 0xc0,add ebx, dword ptr [edi - 0x2a],jg 0x8001ac25,add edx, ebp," "psmachine_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013f0d,call 0x18001426c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180013db8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x180013f46,mov rcx, rbx,call 0x18001c3ac,test eax, eax,je 0x180013f56,mov rcx, rbx,call 0x180018a94,test rax, rax,je 0x180013f37," "psuser_64.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013f0d,call 0x18001426c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180013db8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,jmp 0x180013f46,mov rcx, rbx,call 0x18001c3ac,test eax, eax,je 0x180013f56,mov rcx, rbx,call 0x180018a94,test rax, rax,je 0x180013f37," "psmachine_arm64.dll" file has an entrypoint instructions - "push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001718a,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,and eax, dword ptr [eax],add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4]," "psuser_arm64.dll" file has an entrypoint instructions - "push ebx,mov esi, 0xbf5a9,stc ,std ,jnp 0x8001718a,test eax, 0x910003fd,add eax, dword ptr [ecx],sub bh, byte ptr [edi + 6],add byte ptr [ecx - 0xc], dh,add eax, dword ptr [eax],stosb byte ptr es:[edi], al,cmc ,add eax, dword ptr [edx],stosb byte ptr es:[edi], al,inc ecx,add byte ptr [eax], al,push esp,and eax, dword ptr [eax],add byte ptr [edx - 0x1e55eafd], dl,add edx, dword ptr [ebx],sub ah, al,add edx, dword ptr [edx + ebp*4]," "psmachine.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10011dae,call 0x10012192,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10011c6a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x10011dd5,push dword ptr [ebp + 8],call 0x10019e77,pop ecx,test eax, eax,je 0x10011de4,push dword ptr [ebp + 8],call 0x10016ad0,pop ecx,test eax, eax,je 0x10011dc8,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1001238a,jmp 0x1001236d,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "psuser.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10011dae,call 0x10012192,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10011c6a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x10011dd5,push dword ptr [ebp + 8],call 0x10019e77,pop ecx,test eax, eax,je 0x10011de4,push dword ptr [ebp + 8],call 0x10016ad0,pop ecx,test eax, eax,je 0x10011dc8,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1001238a,jmp 0x1001236d,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "psmachine.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000eb65,call 0x1000ef58,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000ea21,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x1000eb8c,push dword ptr [ebp + 8],call 0x1001692b,pop ecx,test eax, eax,je 0x1000eb9b,push dword ptr [ebp + 8],call 0x100135a9,pop ecx,test eax, eax,je 0x1000eb7f,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1000f12a,jmp 0x1000f10d,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "psuser.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000eb65,call 0x1000ef58,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000ea21,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,jmp 0x1000eb8c,push dword ptr [ebp + 8],call 0x1001692b,pop ecx,test eax, eax,je 0x1000eb9b,push dword ptr [ebp + 8],call 0x100135a9,pop ecx,test eax, eax,je 0x1000eb7f,pop ebp,ret ,cmp dword ptr [ebp + 8], -1,je 0x1000f12a,jmp 0x1000f10d,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17," "MicrosoftEdgeUpdateCore.exe" file has an entrypoint instructions - "call 0x40d507,jmp 0x40cdc2,push ebp,mov ebp, esp,push 0,call dword ptr [0x4210f4],push dword ptr [ebp + 8],call dword ptr [0x4210f0],push 0xc0000409,call dword ptr [0x4210f8],push eax,call dword ptr [0x4210fc],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x421100],test eax, eax,je 0x40cf8c,push 2,pop ecx,int 0x29,mov dword ptr [0x43ade8], eax,mov dword ptr [0x43ade4], ecx,mov dword ptr [0x43ade0], edx,mov dword ptr [0x43addc], ebx," "MicrosoftEdgeUpdateCore.exe" file has an entrypoint instructions - "call 0x40ae2d,jmp 0x40a6f5,ret ,push ebp,mov ebp, esp,push 0,call dword ptr [0x41f0ec],push dword ptr [ebp + 8],call dword ptr [0x41f0e8],push 0xc0000409,call dword ptr [0x41f0f0],push eax,call dword ptr [0x41f0f4],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x41ae53,test eax, eax,je 0x40a8bd,push 2,pop ecx,int 0x29,mov dword ptr [0x434e08], eax,mov dword ptr [0x434e04], ecx,mov dword ptr [0x434e00], edx,mov dword ptr [0x434dfc], ebx," "MicrosoftEdgeUpdateComRegisterShell64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140006628,add rsp, 0x28,jmp 0x140005c3c,int3 ,int3 ,jmp 0x140006340,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x140006bd8,test eax, eax,je 0x140005dfa,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x140005ded,cmp rcx, rax,je 0x140005e01,xor eax, eax,lock cmpxchg qword ptr [rip + 0x2c148], rcx,jne 0x140005de8,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x140005dfc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "MicrosoftEdgeUpdate.exe" file has an entrypoint instructions - "call 0x40b9d7,jmp 0x40b496,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b683,mov dword ptr [esi], 0x4011b4,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x4011bc,mov dword ptr [ecx], 0x4011b4,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b683,mov dword ptr [esi], 0x4011d0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "MicrosoftEdgeUpdateComRegisterShell64.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140005e7c,add rsp, 0x28,jmp 0x140005514,int3 ,int3 ,jmp 0x140005b5c,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x140006404,test eax, eax,je 0x1400056d2,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x1400056c5,cmp rcx, rax,je 0x1400056d9,xor eax, eax,lock cmpxchg qword ptr [rip + 0x2a900], rcx,jne 0x1400056c0,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x1400056d4,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20," "MicrosoftEdgeUpdate.exe" file has an entrypoint instructions - "call 0x40bbc0,jmp 0x40b642,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b850,mov dword ptr [esi], 0x40133c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x401344,mov dword ptr [ecx], 0x40133c,ret ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x40b850,mov dword ptr [esi], 0x401358," "MicrosoftEdgeComRegisterShellARM64.exe" file has an entrypoint instructions - "jg 0x40007c55,add edx, ebp,std ,jnp 0x40007bf6,test eax, 0x910003fd,push edi,add dword ptr [eax], eax,xchg eax, esp," "MicrosoftEdgeComRegisterShellARM64.exe" file has an entrypoint instructions - "std ,jnp 0x40006f0a,test eax, 0x910003fd,add dword ptr ds:[eax], eax,xchg eax, esp,xchg eax, ebp," "MicrosoftEdgeUpdateBroker.exe" file has an entrypoint instructions - "call 0x40173f,jmp 0x40130a,cmp ecx, dword ptr [0x413008],bnd jne 0x40149b,bnd ret ,bnd jmp 0x401ae3,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x4014dc,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x4014d5,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x4014e1,add edx, 0x28,cmp edx, esi,jne 0x4014c6,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x4014de,push esi," "MicrosoftEdgeUpdateOnDemand.exe" file has an entrypoint instructions - "call 0x40173f,jmp 0x40130a,cmp ecx, dword ptr [0x413008],bnd jne 0x40149b,bnd ret ,bnd jmp 0x401ae3,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x4014dc,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x4014d5,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x4014e1,add edx, 0x28,cmp edx, esi,jne 0x4014c6,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x4014de,push esi," "MicrosoftEdgeUpdateBroker.exe" file has an entrypoint instructions - "call 0x401771,jmp 0x401332,cmp ecx, dword ptr [0x413008],jne 0x4014c3,ret ,jmp 0x401b1d,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,ret 0,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x40150e,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x401507,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x401513,add edx, 0x28,cmp edx, esi,jne 0x4014f8,xor eax, eax,pop esi,pop ebp,ret ,"4b:T650,"msedgeupdate.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psmachine.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "psuser.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateCore.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdate.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateBroker.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MicrosoftEdgeUpdateOnDemand.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_de.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_el.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_ml.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_fr-CA.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_pl.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_lb.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_ca.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_it.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_nl.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_fr.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msedgeupdateres_gd.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4c:T562,Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe" enable=yes" (UID: 00000000-00007456) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow program=%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe enable=yes" (UID: 00000000-00008620) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%TEMP%\\\\Runtime Broker.exe" enable=yes" (UID: 00000000-00007192) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe" enable=yes" (UID: 00000000-00007124) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe" enable=yes" (UID: 00000000-00001084) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe" enable=yes" (UID: 00000000-00008480)4d:T73a,Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: msedgeupdate.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: psmachine_64.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: psuser_64.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: psuser_arm64.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: psmachine_arm64.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: psmachine.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: psuser.dll] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: MicrosoftEdgeUpdateComRegisterShell64.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: MicrosoftEdgeUpdate.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: MicrosoftEdgeComRegisterShellARM64.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: MicrosoftEdgeUpdateBroker.exe] Observed import api "GetCommandLineA" which can "Retrieves the command-line string for the current process" [Source: MicrosoftEdgeUpdateOnDemand.exe]4e:T112c,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorControl" which can "Retrieves a security descriptor control and revision information" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorGroup" which can "Retrieves the primary group information from a security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorLength" which can "Returns the length in bytes of a structurally valid security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorOwner" which can "Retrieves the owner information from a security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSecurityDescriptorSacl" which can "Retrieves a pointer to the system access control list (SACL) in a specified security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSidLengthRequired" which can "Returns the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "IsValidSid" which can "Validates a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "MakeAbsoluteSD" which can "Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "MakeSelfRelativeSD" which can "Creates a security descriptor in self-relative format by using a security descriptor in absolute format as a template" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: MicrosoftEdgeUpdateCore.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: MicrosoftEdgeUpdateCore.exe]4f:T4e6,"msedgeupdate.dll" was detected as "Borland Delphi 3.0 (???)" "psmachine.dll" was detected as "Borland Delphi 3.0 (???)" "psuser.dll" was detected as "Borland Delphi 3.0 (???)" "MicrosoftEdgeUpdateCore.exe" was detected as "VC8 -> Microsoft Corporation" "MicrosoftEdgeUpdate.exe" was detected as "VC8 -> Microsoft Corporation" "MicrosoftEdgeUpdateBroker.exe" was detected as "VC8 -> Microsoft Corporation" "MicrosoftEdgeUpdateOnDemand.exe" was detected as "VC8 -> Microsoft Corporation" "msedgeupdateres_de.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_el.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_ml.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_fr-CA.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_pl.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_lb.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_ca.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_it.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_nl.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_fr.dll" was detected as "Borland Delphi 3.0 (???)" "msedgeupdateres_gd.dll" was detected as "Borland Delphi 3.0 (???)"50:T77f,"msedgeupdate.dll" claimed CRC 2202676 while the actual is CRC 2526115 "psmachine_64.dll" claimed CRC 444650 while the actual is CRC 2202676 "psuser_64.dll" claimed CRC 468668 while the actual is CRC 444650 "psuser_arm64.dll" claimed CRC 427664 while the actual is CRC 468668 "psmachine_arm64.dll" claimed CRC 395479 while the actual is CRC 427664 "psmachine_64.dll" claimed CRC 384030 while the actual is CRC 395479 "psuser_64.dll" claimed CRC 388580 while the actual is CRC 384030 "psmachine_arm64.dll" claimed CRC 373942 while the actual is CRC 388580 "psuser_arm64.dll" claimed CRC 336915 while the actual is CRC 373942 "psmachine.dll" claimed CRC 353054 while the actual is CRC 336915 "psuser.dll" claimed CRC 377051 while the actual is CRC 353054 "psmachine.dll" claimed CRC 366053 while the actual is CRC 377051 "psuser.dll" claimed CRC 340731 while the actual is CRC 366053 "MicrosoftEdgeUpdateCore.exe" claimed CRC 320413 while the actual is CRC 340731 "MicrosoftEdgeUpdateCore.exe" claimed CRC 244645 while the actual is CRC 320413 "MicrosoftEdgeUpdateComRegisterShell64.exe" claimed CRC 244796 while the actual is CRC 244645 "MicrosoftEdgeUpdate.exe" claimed CRC 265980 while the actual is CRC 244796 "MicrosoftEdgeUpdateComRegisterShell64.exe" claimed CRC 229615 while the actual is CRC 265980 "MicrosoftEdgeUpdate.exe" claimed CRC 218835 while the actual is CRC 229615 "MicrosoftEdgeComRegisterShellARM64.exe" claimed CRC 194421 while the actual is CRC 218835 "MicrosoftEdgeComRegisterShellARM64.exe" claimed CRC 217301 while the actual is CRC 194421 "MicrosoftEdgeUpdateBroker.exe" claimed CRC 116978 while the actual is CRC 217301 "MicrosoftEdgeUpdateOnDemand.exe" claimed CRC 156046 while the actual is CRC 116978 "MicrosoftEdgeUpdateBroker.exe" claimed CRC 127687 while the actual is CRC 156046 "MicrosoftEdgeUpdateOnDemand.exe" claimed CRC 138337 while the actual is CRC 12768751:T491,GetComputerNameExW GetFileAttributesA GetFileAttributesW UnhandledExceptionFilter GetTempPathA FindResourceExW OutputDebugStringA DeviceIoControl CopyFileW OutputDebugStringW GetModuleFileNameW IsDebuggerPresent GetVersionExA GetModuleFileNameA LoadLibraryExA LoadLibraryExW CreateThread GetSystemDirectoryW ExitThread GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetTickCount VirtualProtect LoadLibraryA GetFileSize OpenProcess DeleteFileA GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW CreateFileMappingW WriteFile GetFileSizeEx FindNextFileW CreateFileMappingA FindFirstFileW FindFirstFileExW GetTempPathW CreateFileW CreateFileA GetNativeSystemInfo GetSystemInfo Process32NextW LockResource GetCommandLineW GetCommandLineA Process32FirstW GetTickCount64 MapViewOfFile GetModuleHandleA GetModuleHandleW GetFileAttributesExW FindResourceW CreateProcessW Sleep TerminateProcess VirtualAlloc SleepConditionVariableCS SleepConditionVariableSRW RegCreateKeyExW RegCloseKey SetSecurityDescriptorDacl RegOpenKeyExW OpenProcessToken52:T562,Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe" enable=yes" (UID: 00000000-00007456) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow program=%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe enable=yes" (UID: 00000000-00008620) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%TEMP%\\\\Runtime Broker.exe" enable=yes" (UID: 00000000-00007192) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe" enable=yes" (UID: 00000000-00007124) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe" enable=yes" (UID: 00000000-00001084) Process "netsh.exe" with commandline "advfirewall firewall add rule "name=Microsoft Edge WebEngine" dir=in action=allow "program=%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe" enable=yes" (UID: 00000000-00008480)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790356429349,"unified_at":"2026-09-25T17:13:49.349Z","metadata":{"hashes":{"sha256":"ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527","sha1":"656eab9b23906ac7f0ff0eecd5077979a79b3f93","md5":"617205f5a241c2712d4d0a3b06ce3afd","sha512":"d8c13445df3a2dc858bc00ead5e075f4bba802583975e576a469fc4ec8c619f0bf20d36bcfd869c78fd6713d5b9d0c42a2c591874dd2444da911fd154f4af830","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Runtime Broker.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":54296552,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706034577000,"last_seen":1722855394000,"last_multi_scan":1722855394000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banking","criminal","ransomware","rm3","shaderansomware","suspicious"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":86},"sandbox_signatures":{"informative_count":208,"suspicious_count":15,"malicious_count":7,"total":230},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.PowerShell","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan/PowerShell","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"suspicious","value":"Tries to modify exclusion list using Powershell"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volatile registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve network shares information"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"malicious","value":"Contacts many different hosts"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"suspicious","value":"Looks up many procedures within the same disassembly stream (often used to hide usage)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"malicious","value":"Modifies firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: Runtime Broker.exe","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"Call to IsWow64Process2 failed: %u\" (Indicator: \"IsWow64Process\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set JArray values with invalid key value: {0}. Int32 array index expected.\" (Indicator: \"set \"; File: \"Runtime Broker.exe\")\n Found string \"Set JConstructor values with invalid key value: {0}. Argument position index expected.\" (Indicator: \"set \"; File: \"Runtime Broker.exe\")\n Found string \"Set JObject values with invalid key value: {0}. Object property name expected.\" (Indicator: \"set \"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"RuntimeBroker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"RuntimeBroker.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\dotnet-diagnostic-3880\" - (UID: 00000000-00003880)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"Failed to map file. CreateFileW(%s) failed with error %d\" (Indicator: \"CreateFile\"; File: \"Runtime Broker.exe\")\n Found reference to API \"Failed to map file. CreateFileMappingW(%s) failed with error %d\" (Indicator: \"CreateFile\"; File: \"Runtime Broker.exe\")\n Found reference to API \"InvalidOperation_CantCreateFileMapping\" (Indicator: \"CreateFile\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"UseShellExecuteNotSupported\" (Indicator: \"ShellExecute\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: Runtime Broker.exe\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\\AutoExclusionList\" in Source: Runtime Broker.exe\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug\" in Source: Runtime Broker.exe\n \"SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\DebugApplications\" in Source: Runtime Broker.exe\n \"SOFTWARE\\Classes\\\" in Source: Runtime Broker.exe\n \"SOFTWARE\\dotnet\" in Source: Runtime Broker.exe\n \"SOFTWARE\\Microsoft\\Office\\10.0\\Registration\\{90280409-6000-11D3-8CFE-0050048383C9}\" in Source: Runtime Broker.exe\n \"/c reg query \"HKEY_LOCAL_MACHINE\\\" in Source: Runtime Broker.exe, \"SOFTWARE\\dotnet\\Setup\" in Source: Runtime Broker.exe","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Runtime Broker.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"Runtime Broker.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"RuntimeBroker.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$25","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"RuntimeBroker.exe\" trying to access non-existent file \"C:\\RUNTIME BROKER.RUNTIMECONFIG.DEV.JSON\"\n \"RuntimeBroker.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\CORESERVICING\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"2.3.3.0\"\n \"13.0.0.0\"\n \"1.0.2.0\"\n \"1.0.1.0\"\n \"1.3.0.0\"\n \"6.0.0.0\"\n \"4.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://aka.ms/dotnet/runtimes-sdk-info\"\n Pattern match: \"https://aka.ms/dotnet-download\"\n Pattern match: \"https://aka.ms/dotnet/app-launch-failedTo\"\n Pattern match: \"https://aka.ms/dotnet/sdk-not-found\"\n Pattern match: \"https://aka.ms/dotnet-core-applaunch\"\n Pattern match: \"https://aka.ms/dotnet/app-launch-failed\"\n Pattern match: \"http://www.w3.org/2000/xmlns/\"\n Pattern match: \"http://james.newtonking.com/projects/json\"\n Heuristic match: \"Json.NET is a popular high-performance JSON framework for .NET\"\n Heuristic match: \"Json.NET\"\n Pattern match: \"https://api.ipify.org\"\n Pattern match: \"http://ipinfo.io/\"\n Pattern match: \"https://api.seeip.org/\"\n Pattern match: \"http://www.w3.org/\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"Runtime Broker.exe\")\n Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://aka.ms\"\n Found HTTPS url \"https://api.ipify.org\"\n Found HTTPS url \"https://api.seeip.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"EnableAES\" (Indicator: \"aes\"; File: \"Runtime Broker.exe\")\n Found string \"GZipStream\" (Indicator: \"GzipStream\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"Failed to map file. GetFileSizeEx(%s) failed with error %d\" (Indicator: \"GetFileSize\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"/api/v1/browser-passwords\" (Indicator: \"password\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeLockMemoryPrivilege\" (Indicator: \"SeLockMemoryPrivilege\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"RuntimeBroker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"RuntimeBroker.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3880)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"t@f9.t\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to retrieve network shares information","description":"Found string \"-- arguments_t: dotnet shared store: '%s'\" (Indicator: \"net share\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-364","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"Runtime Broker.exe\")\n \"http://ipinfo.io/\" (Indicator: \"ipinfo.io\"; File: \"Runtime Broker.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"},{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.22710000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007280-00000BC0-82864374\")\n Found reference to \"RandomNumberGenerator\" (Indicator: \"RandomNumberGenerator\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.22680000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$29","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-4072; Source: \"00000000-00004072-00000C51-57608280\")\n Found string - \\\\.\\pipe\\dotnet-diagnostic-4072; Source: \"00000000-00004072.00000000.66746.20A80000.00000004.mdmp, 00000000-00004072.00000001.68665.20A80000.00000004.mdmp, 00000000-00004072.00000002.70584.20A80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"Runtime Broker.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tor-data\\state.tmp\" to \"%TEMP%\\tor-data\\state\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000580.00000002.70910.759D0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000776.00000001.68967.FDC80000.00000004.mdmp, 00000000-00000776.00000002.70887.FDC80000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003404.00000002.70923.B7F40000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003900.00000001.68935.45660000.00000004.mdmp, 00000000-00003900.00000002.70858.45660000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003920.00000001.68975.32640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"kipping current X509Certificate2 {0} since it doesn't have private key. Certificate Subject: {1}, Thumbprint: {2}.\" (Indicator: \"private key\"; Source: \"00000000-00004072.00000001.68665.22680000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"out.exe\" called \"IsWow64Process\" with parameter \"4072\" - (UID: 00000000-00004072)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00007280)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"out.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004072)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007280)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00007280)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007280)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003900)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006568)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006356)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006092)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000776)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006056)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003920)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00007356)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000580)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006088)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"out.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"out.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Runtime Broker.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004072.00000000.66746.227C0000.00000004.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"out.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"out.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$30","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"out.exe\" called \"CreateDirectoryW\" with parameter \\\\?\\%LOCALAPPDATA%\\Microsoft\\Windows\\Applications (UID: 00000000-00004072)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"out.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\dotnet-diagnostic-4072\"\n dwOpenMode: \"1074266115\"\n dwPipeMode: \"8\" - (UID: 00000000-00004072)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"116.203.17.238:9001\"\n \"84.158.138.52:10222\"\n \"131.188.40.189:443\"\n \"87.62.96.246:9032\"\n \"86.59.21.38:443\"\n \"51.15.54.117:443\"\n \"51.15.59.15:444\"\n \"193.23.244.244:443\"\n \"78.31.67.22:9001\"\n \"171.25.193.9:80\"\n \"103.28.52.93:443\"\n \"45.66.35.11:443\"\n \"130.162.218.212:9001\"\n \"199.58.81.140:443\"\n \"128.31.0.39:9201\"\n \"89.236.112.100:443\"\n \"204.13.164.118:443\"\n \"185.220.101.206:443\"\n \"178.254.6.130:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"StartWithCreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"12001276785,4020,3137,,CreateProcessW,kernel32.dll,\"00:17:22.968\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004072.00000000.66746.454F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"k__BackingField\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"get_LoadUserProfile\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetOrOpenProcessHandle\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$34","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\dotnet-diagnostic-4072","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"RepositoryUrl!https://github.com/dotnet/runtime\" (Indicator: \"github.com\")\n \"JustificationXWorkarounds https://github.com/mono/linker/issues/1416. All usages are marked as unsafe.\" (Indicator: \"github.com\")\n \"JustificationXWorkarounds https://github.com/mono/linker/issues/1906. All usages are marked as unsafe.\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at E2270000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at FF040000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"out.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0B370000\n \"out.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0AB70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 0B370000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 0AB70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EBD80000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"out.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0CDE0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0CDE0000\n \"Runtime Broker.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 0CDE0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7ef0bfa7f0000@ntdll.dll\"\n \"220023000000000018c7ef0bfa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"Runtime Broker.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"Runtime Broker.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007280-00000BC0-121422562]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"out.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"out.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"out.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"out.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$38","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$39","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"out.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Runtime Broker.exe\"\n \"Runtime Broker.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tor-data\\state.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Runtime Broker.exe\" has type \"PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\Runtime Broker.exe]- [targetUID: 00000000-00004072]\n \"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007280]\n \"state.tmp\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\tor-data\\state.tmp]- [targetUID: 00000000-00007208]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"state.tmp\" has type \"ASCII text with CRLF line terminators\" - Location: [%TEMP%\\tor-data\\state.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"out.exe\" queries basic process information of the \"C:\\out.exe\" (UID: 4072)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"out.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004072)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"\n \"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\microsoft.powershell.consolehost.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\"\n \"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\system.management.automation.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"Runtime Broker.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Runtime Broker.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"out.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\runtime broker.exe\"\n \"out.exe\" writes file \"%temp%\\runtime broker.exe\"\n \"Runtime Broker.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\tor-data\\state.tmp\"\n \"Runtime Broker.exe\" writes file \"%temp%\\tor-data\\state.tmp\"\n \"powershell.exe\" writes file \"%localappdata%\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"http://n34kr3z26f3jzp4ckmwuv5ipqyatumdxhgjgsmucc65jac56khdy5zqd.onion\" (Indicator: \".onion\") in Source: 00000000-00004072.00000000.66746.227C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004072-00000C26-67310860\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004072-00000C26-75539832\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004072-00000C26-75549752\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"CreatePipeWithSecurityAttributes\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 140e0f0cad708278ade0984528fe8493\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports\n Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"131.188.40.189\" on port \"443\"\n HTTPS traffic to \"86.59.21.38\" on port \"443\"\n HTTPS traffic to \"51.15.54.117\" on port \"443\"\n HTTPS traffic to \"193.23.244.244\" on port \"443\"\n HTTPS traffic to \"103.28.52.93\" on port \"443\"\n HTTPS traffic to \"45.66.35.11\" on port \"443\"\n HTTPS traffic to \"199.58.81.140\" on port \"443\"\n HTTPS traffic to \"89.236.112.100\" on port \"443\"\n HTTPS traffic to \"204.13.164.118\" on port \"443\"\n HTTPS traffic to \"185.220.101.206\" on port \"443\"\n HTTPS traffic to \"178.254.6.130\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEC60BAE54130130E31368AB83A4A4]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000580.00000002.70910.759D0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE14580DF8A5A0BBEBBCBCDCFDF38A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000776.00000002.70887.FDC80000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE1DBB42665B671FBFC600B88F3167]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003404.00000002.70923.B7F40000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE4B84FE39EC32A43668D0510022B2]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003900.00000002.70858.45660000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEEAA7A9588394CB7DDBCBDD3C12EF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003920.00000002.70893.32640000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"out.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"LsaGetLogonSessionData\" (Indicator: \"GetLogonSessionData\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"153863819793,7240,3024,,RtlGetVersion,NTDLL.dll,\"00:18:26.718\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003900.00000002.70858.45660000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"GetProcessIdFromHandle\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"GetProcessIds\" (Indicator: \"GetProcessId\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"GetComputerName\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.22680000.00000002.mdmp, 00000000-00004072.00000001.68665.22710000.00000002.mdmp, 00000000-00004072.00000001.68665.45BA0000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariablesBlock\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"out.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004072)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007280)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003900)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006568)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006092)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006056)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003920)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007356)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000580)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")\n Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00004072.00000001.68665.225A0000.00000002.mdmp, 00000000-00004072.00000002.70584.45B80000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004072-00000C26-68838602\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004072.00000001.68665.22680000.00000002.mdmp\n 00000000-00004072.00000001.68665.45BA0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004072.00000000.66746.454C0000.00000002.mdmp, 00000000-00004072.00000001.68665.7EC1B000.00000002.mdmp, 00000000-00004072.00000002.70584.7EA4D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003900.00000002.70858.FAAD2000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003920.00000002.70893.C278A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System Runtime Monitor.exe'\" (UID: 00000000-00007280)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%APPDATA%\\\\Microsoft\\\\Windows\\\\Applications\\\\Runtime Broker.exe'\" (UID: 00000000-00003900)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Applications\\\\Runtime Broker.exe'\" (UID: 00000000-00006568)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%APPDATA%\\\\Microsoft\\\\Windows\\\\Dependencies\\\\System Runtime Monitor.exe'\" (UID: 00000000-00006356)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\Microsoft\\\\WindowsApps\\\\msedge.exe'\" (UID: 00000000-00006092)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%TEMP%\\\\\\\\Runtime Broker.exe'\" (UID: 00000000-00000776)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Runtime Broker.exe\" has type \"PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\Runtime Broker.exe]- [targetUID: 00000000-00004072]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007280]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Runtime Broker.exe\" reads file \"C:\\Users\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Runtime Broker.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Runtime Broker.exe\" has type \"PE32+ executable (console) x86-64 (stripped to external PDB) for MS Windows\"- Location: [%TEMP%\\Runtime Broker.exe]- [targetUID: 00000000-00004072]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"out.exe\" wrote 5120 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Runtime Broker.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0e00 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 131.188.40.189 on port 443 is sent without HTTP header\n TCP traffic to 86.59.21.38 on port 443 is sent without HTTP header\n TCP traffic to 51.15.54.117 on port 443 is sent without HTTP header\n TCP traffic to 193.23.244.244 on port 443 is sent without HTTP header\n TCP traffic to 171.25.193.9 on port 80 is sent without HTTP header\n TCP traffic to 103.28.52.93 on port 443 is sent without HTTP header\n TCP traffic to 45.66.35.11 on port 443 is sent without HTTP header\n TCP traffic to 199.58.81.140 on port 443 is sent without HTTP header\n TCP traffic to 89.236.112.100 on port 443 is sent without HTTP header\n TCP traffic to 204.13.164.118 on port 443 is sent without HTTP header\n TCP traffic to 185.220.101.206 on port 443 is sent without HTTP header\n TCP traffic to 178.254.6.130 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"Runtime Broker.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tor-data\\state.tmp\" with delete access\n \"Runtime Broker.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tor-data\\KEY-PINNING-ENTRIES\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"suspicious","category":"System Security","name":"Tries to modify exclusion list using Powershell","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System Runtime Monitor.exe'\" (UID: 00000000-00007280)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%APPDATA%\\\\Microsoft\\\\Windows\\\\Applications\\\\Runtime Broker.exe'\" (UID: 00000000-00003900)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\Applications\\\\Runtime Broker.exe'\" (UID: 00000000-00006568)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%APPDATA%\\\\Microsoft\\\\Windows\\\\Dependencies\\\\System Runtime Monitor.exe'\" (UID: 00000000-00006356)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\\\Microsoft\\\\WindowsApps\\\\msedge.exe'\" (UID: 00000000-00006092)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath '%TEMP%\\\\\\\\Runtime Broker.exe'\" (UID: 00000000-00000776)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":5,"id":"target-320","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F0\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$41","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"malicious","category":"Network Related","name":"Contacts many different hosts","description":"Contacted 19 (or more) hosts in at least 0 different countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 116.203.17.238 on port 9001\n TCP traffic to 84.158.138.52 on port 10222\n TCP traffic to 87.62.96.246 on port 9032\n TCP traffic to 78.31.67.22 on port 9001\n TCP traffic to 130.162.218.212 on port 9001\n TCP traffic to 128.31.0.39 on port 9201","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$42","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003440)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003440)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003440)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003440)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '1551233843201', 'hResInfo': '1551233851616'}\" (UID: 00000000-00003440)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1551233843201', 'hResInfo': '1551233851648'}\" (UID: 00000000-00003440)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1551233843201', 'hResInfo': '1551233851664'}\" (UID: 00000000-00003440)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '1551233843201', 'hResInfo': '1551233851632'}\" (UID: 00000000-00003440)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"# valid values (supported on all paltforms where Format-Hex is avaliable)\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"# 170..180 | format-hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"# PS# 170..180 | format-hex -Raw\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"i;$i64 } | format-hex\" (Indicator: \"Format-Hex\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"function ConvertFrom-SddlString\" (Indicator: \"ConvertFrom-SddlString\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 30017-1157-0040A87C\n SetUnhandledExceptionFilter@KERNEL32.dll at 30017-1707-0040AB33\n SetUnhandledExceptionFilter@KERNEL32.dll at 43938-1113-0040D205","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$43","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$44","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001332.00000002.72814.C7800000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001332.00000002.72814.C7890000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008668)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00004496)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006320)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008536)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006740)\n \"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008868)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 30017-1069-00405141\n GetTickCount@KERNEL32.dll at 43938-1210-00405FF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExW@KERNEL32.dll at 30017-1178-0041181A\n FindFirstFileExW@KERNEL32.dll at 43938-1348-00413974","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 30017-1053-004072AE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00001332.00000001.70894.094A0000.00000004.mdmp\n 00000000-00001332.00000002.72814.094A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 30017-1785-00412892\n GetProcessHeap@KERNEL32.dll at 43938-1055-00414A10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"$46","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 30017-1092-00406F45\n Sleep@KERNEL32.dll at 30017-1499-0041E5F3\n Sleep@KERNEL32.dll at 30017-1069-00405141\n Sleep@KERNEL32.dll at 43938-1210-00405FF0\n Sleep@KERNEL32.dll at 43938-1016-00420980\n WaitForSingleObject@KERNEL32.dll at 43938-1163-0040807F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: msedgeupdate.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 30017-1271-0041E071\n LoadLibraryExW@KERNEL32.dll at 30017-1047-00403D43\n LoadLibraryExW@KERNEL32.dll at 43938-1301-0040C6CC\n LoadLibraryExA@KERNEL32.dll at 43938-1404-004205A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$47","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$48","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"$resolvedPaths = Resolve-Path -LiteralPath $f\" (Indicator: \"Resolve-Path\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"= Resolve-Path -Path $filePath\" (Indicator: \"Resolve-Path\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"Write-Error -Message $errorMessage -Category\" (Indicator: \"Write-Error\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"Write-Error -Message $errorMessage -Category ([System.Management.Automat$:\" (Indicator: \"Write-Error\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")\n Found string \"$resolvedPath in (Resolve-Path @PSBoundParameters))\" (Indicator: \"Resolve-Path\"; Source: \"00000000-00001332.00000001.70894.23760000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"$49","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"msedgeupdate.dll\" has an executable section named \".text\"\n \"psmachine_64.dll\" has an executable section named \".text\"\n \"psmachine_64.dll\" has an executable section named \".orpc\"\n \"psuser_64.dll\" has an executable section named \".text\"\n \"psuser_64.dll\" has an executable section named \".orpc\"\n \"psuser_arm64.dll\" has an executable section named \".text\"\n \"psuser_arm64.dll\" has an executable section named \".orpc\"\n \"psmachine_arm64.dll\" has an executable section named \".text\"\n \"psmachine_arm64.dll\" has an executable section named \".orpc\"\n \"psmachine.dll\" has an executable section named \".text\"\n \"psmachine.dll\" has an executable section named \".orpc\"\n \"psuser.dll\" has an executable section named \".text\"\n \"psuser.dll\" has an executable section named \".orpc\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"KERNEL32.dll\" : \"253\" [Source: msedgeupdate.dll]\n Observed large number of imported APIs from \"KERNEL32.dll\" : \"233\" [Source: msedgeupdate.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"msedgeupdate.dll\" has an writable section named \".data\"\n \"msedgeupdate.dll\" has an writable section named \".didat\"\n \"psmachine_64.dll\" has an writable section named \".data\"\n \"psmachine_64.dll\" has an writable section named \".didat\"\n \"psuser_64.dll\" has an writable section named \".data\"\n \"psuser_64.dll\" has an writable section named \".didat\"\n \"psuser_arm64.dll\" has an writable section named \".data\"\n \"psuser_arm64.dll\" has an writable section named \".didat\"\n \"psmachine_arm64.dll\" has an writable section named \".data\"\n \"psmachine_arm64.dll\" has an writable section named \".didat\"\n \"psmachine.dll\" has an writable section named \".data\"\n \"psmachine.dll\" has an writable section named \".didat\"\n \"psuser.dll\" has an writable section named \".data\"\n \"psuser.dll\" has an writable section named \".didat\"\n \"MicrosoftEdgeUpdateCore.exe\" has an writable section named \".data\"\n \"MicrosoftEdgeUpdateCore.exe\" has an writable section named \".didat\"\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x1a7200\" greater than 0x100000\n Raw size of \".text\" is \"0x15d000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1a7077\" greater than 0x100000\n Virtual size of \".text\" is \"0x15ceaa\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"psmachine_64.dll\" has high imagebase \"0x180000000\"\n \"psuser_64.dll\" has high imagebase \"0x180000000\"\n \"psuser_arm64.dll\" has high imagebase \"0x180000000\"\n \"psmachine_arm64.dll\" has high imagebase \"0x180000000\"\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\" has high imagebase \"0x140000000\"\n \"MicrosoftEdgeComRegisterShellARM64.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"netsh.exe\" (UID: 00000000-00007456) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$4b","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detect powershell file matched on process \"00000000-00001332\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopShortcut\" (Indicator: \"CreateDesktop\"; File: \"MicrosoftEdgeUpdateCore.exe.3423426546\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003440)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00004876)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00001332)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005512)\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00005732)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"psmachine_64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psuser_64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psuser_arm64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psmachine_arm64.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psmachine.dll\" contains export function called \"DllGetClassObject\" at ordinal 2\n \"psuser.dll\" contains export function called \"DllGetClassObject\" at ordinal 2","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge Update\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: MicrosoftEdgeUpdateCore.exe.411546343\n \"e\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Microsoft Edge Update\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: MicrosoftEdgeUpdateCore.exe.3423426546","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"MicrosoftEdgeUpdateCore.exe.411546343\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001332.00000002.72814.180AA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$4f","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 32 calls to GetProcAddress@KERNEL32.dll at 30017-1472-0041B879","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.07490205799\n 7.06916231304","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$50","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$51","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"PE file contains executable resources","description":"msedgeupdateres_ml.dll has PE file in resource with name: \"RT_STRING\" and filetype:CLIPPER COFF executable C2 R1 not stripped - version 37 alignment trap enabled\n msedgeupdateres_gd.dll has PE file in resource with name: \"RT_STRING\" and filetype:CLIPPER COFF executable C1 R1 not stripped - version 111 alignment trap enabled\n msedgeupdateres_bn-IN.dll has PE file in resource with name: \"RT_STRING\" and filetype:CLIPPER COFF executable C1 R1 not stripped - version 33 alignment trap enabled\n msedgeupdateres_bn.dll has PE file in resource with name: \"RT_STRING\" and filetype:CLIPPER COFF executable C1 R1 not stripped - version 33 alignment trap enabled","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1562.004","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}]},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":123,"imported_dlls_count":154,"dropped_files_count":0,"extracted_files_count":122,"files_written_count":50,"files_deleted_count":0,"registry_keys_created_count":43,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":43,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":84,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["banking","criminal","ransomware","rm3","shaderansomware","suspicious"],"sample_flags":["User Comment","Simulated analysis","Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6658fa7d6a862334720ad293","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"ERROR","error_type":"File \"out\" was detected as \"64-bit exe\", this format is not supported on LINUX","verdict":"undetected","submit_name":"out","analysis_start_time":"2024-05-30T22:15:26+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"65ccaa4c2d580017f30d54a5","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["ARE","AUT","BEL","CAN","CHE","DEU","FIN","FRA","GBR","HUN","LTU","LUX","MDA","NLD","PAN","POL","RUS","SGP","SWE","UKR","USA","ZZZ"],"submit_name":"malwarelol~.exe","analysis_start_time":"2024-02-14T11:55:59+00:00","indicators_count":{"informative":195,"suspicious":58,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"65bf0714173bf788b50f90db","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"Runtime Broker.exe","analysis_start_time":"2024-02-04T03:40:07+00:00","indicators_count":{"informative":28,"suspicious":5,"malicious":1},"tags":["User Comment","Simulated analysis"],"is_in_unified_schema":true},{"id":"65b0058b9658f1206f083aef","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["AUT","CAN","DEU","DNK","FIN","FRA","IDN","NLD","SWE","USA"],"submit_name":"out","analysis_start_time":"2024-01-23T18:29:40+00:00","indicators_count":{"informative":142,"suspicious":29,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"116.203.17.238","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"84.158.138.52","port":10222,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"address":"131.188.40.189","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"87.62.96.246","port":9032,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"address":"86.59.21.38","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.15.54.117","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.15.59.15","port":444,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"address":"193.23.244.244","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"78.31.67.22","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"171.25.193.9","port":80,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"103.28.52.93","port":443,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"address":"45.66.35.11","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"130.162.218.212","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"address":"199.58.81.140","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"128.31.0.39","port":9201,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"89.236.112.100","port":443,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"204.13.164.118","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.220.101.206","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"address":"178.254.6.130","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"140.78.100.22","port":5443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"138.201.35.6","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"152.70.197.164","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.220.101.203","port":8443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"194.76.227.152","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.15.185.201","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"82.66.61.19","port":995,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"212.192.246.55","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.25.51.138","port":9001,"protocol":"TCP","country":"Lithuania","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"23.154.177.3","port":443,"protocol":"TCP","country":"Reserved","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"82.66.10.17","port":19001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.81.208.164","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"23.175.32.11","port":443,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"135.148.100.90","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.181.229.77","port":9001,"protocol":"TCP","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"163.172.211.16","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"142.132.204.165","port":4080,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"144.76.154.13","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"96.126.105.219","port":5353,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"174.128.250.163","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"54.36.120.156","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"65.108.136.183","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"213.144.135.21","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"192.42.116.17","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"50.236.201.218","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"89.147.109.91","port":443,"protocol":"TCP","country":"Hungary","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"213.135.244.242","port":24071,"protocol":"TCP","country":"Luxembourg","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"190.211.254.182","port":9001,"protocol":"TCP","country":"Panama","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.15.75.120","port":444,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.183.157.127","port":9100,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"46.38.232.203","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.159.184.219","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"94.130.246.106","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"178.27.106.248","port":9031,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"5.182.211.119","port":9001,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"85.208.144.164","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"212.32.240.165","port":9001,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"51.81.56.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"5.255.98.7","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"65.108.253.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"116.12.180.237","port":7443,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"157.90.92.115","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"198.98.60.107","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"95.214.54.80","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"50.39.143.177","port":59090,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"45.91.77.77","port":443,"protocol":"TCP","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.14.30.57","port":9001,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"193.105.73.80","port":9001,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.112.156.72","port":443,"protocol":"TCP","country":"Hungary","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"95.216.27.105","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"140.78.100.42","port":5443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"155.248.212.228","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"95.216.101.247","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"199.249.230.118","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"135.148.52.231","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"138.201.123.109","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"204.85.191.9","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.228.136.146","port":9100,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"89.58.3.65","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"89.58.4.238","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"176.10.119.69","port":9001,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"158.69.207.216","port":9001,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"144.217.90.187","port":9001,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"83.78.216.58","port":43633,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"address":"185.140.251.125","port":9001,"protocol":"TCP","country":"United Arab Emirates","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}],"processes":[{"pid":1768,"ppid":0,"name":"malwarelol_.exe","command_line":"","sha256":"ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527","normalized_path":"C:\\malwarelol_.exe","uid":"00000000-00001768","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":3440,"ppid":1768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00003440"},{"pid":4876,"ppid":1768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00004876"},{"pid":1332,"ppid":1768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00001332"},{"pid":5512,"ppid":1768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath '%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00005512"},{"pid":5732,"ppid":1768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath '%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00005732"},{"pid":8448,"ppid":1768,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath '%TEMP%\\\\Runtime Broker.exe'","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00008448"},{"pid":8668,"ppid":1768,"name":"powershell.exe","command_line":"netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe' enable=yes","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00008668"},{"pid":8480,"ppid":8668,"name":"netsh.exe","command_line":"advfirewall firewall add rule \"name=Microsoft Edge WebEngine\" dir=in action=allow \"program=%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System Runtime Monitor.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00008668","uid":"00000000-00008480"},{"pid":4496,"ppid":1768,"name":"powershell.exe","command_line":"netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe' enable=yes","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00004496"},{"pid":1084,"ppid":4496,"name":"netsh.exe","command_line":"advfirewall firewall add rule \"name=Microsoft Edge WebEngine\" dir=in action=allow \"program=%APPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00004496","uid":"00000000-00001084"},{"pid":6320,"ppid":1768,"name":"powershell.exe","command_line":"netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe' enable=yes","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00006320"},{"pid":7124,"ppid":6320,"name":"netsh.exe","command_line":"advfirewall firewall add rule \"name=Microsoft Edge WebEngine\" dir=in action=allow \"program=%LOCALAPPDATA%\\Microsoft\\Windows\\Applications\\Runtime Broker.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006320","uid":"00000000-00007124"},{"pid":8536,"ppid":1768,"name":"powershell.exe","command_line":"netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe' enable=yes","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00008536"},{"pid":7456,"ppid":8536,"name":"netsh.exe","command_line":"advfirewall firewall add rule \"name=Microsoft Edge WebEngine\" dir=in action=allow \"program=%APPDATA%\\Microsoft\\Windows\\Dependencies\\System Runtime Monitor.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00008536","uid":"00000000-00007456"},{"pid":6740,"ppid":1768,"name":"powershell.exe","command_line":"netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe' enable=yes","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00006740"},{"pid":8620,"ppid":6740,"name":"netsh.exe","command_line":"advfirewall firewall add rule \"name=Microsoft Edge WebEngine\" dir=in action=allow program=%LOCALAPPDATA%\\Microsoft\\WindowsApps\\msedge.exe enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006740","uid":"00000000-00008620"},{"pid":8868,"ppid":1768,"name":"powershell.exe","command_line":"netsh advfirewall firewall add rule name='Microsoft Edge WebEngine' dir=in action=allow program='%TEMP%\\\\Runtime Broker.exe' enable=yes","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00001768","uid":"00000000-00008868"},{"pid":7192,"ppid":8868,"name":"netsh.exe","command_line":"advfirewall firewall add rule \"name=Microsoft Edge WebEngine\" dir=in action=allow \"program=%TEMP%\\\\Runtime Broker.exe\" enable=yes","sha256":"3e91414a1a005937925e449627d4634e73b1da9dc12d1008b1baa54c77637c44","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00008868","uid":"00000000-00007192"},{"pid":8752,"ppid":1768,"name":"Runtime Broker.exe","command_line":"--SocksPort 9050 --DataDirectory %TEMP%\\\\tor-data","sha256":"3f424b477ac16463e871726cbb106d41574d2d0e910dee035fbd23241515e770","normalized_path":"%TEMP%\\Runtime Broker.exe","parent_uid":"00000000-00001768","uid":"00000000-00008752"}],"all_imported_dlls":["VxSSL64.dll","cryptbase.dll","ntdll.dll","kernel.appcore.dll","sspicli.dll","mscoree.dll","cryptsp.dll","sechost.dll","fltLib.dll","ntmarta.dll","bcryptprimitives.dll","clr.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","IPHLPAPI.DLL","apphelp.dll","System.Management.ni.dll","dhcpcsvc6.dll","user32.dll","win32u.dll","SHCore.dll","mswsock.dll","System.Management.Automation.ni.dll","3MGj5z13.dll","oleaut32.dll","rsaenh.dll","clbcatq.dll","MpOAV.dll","cldapi.dll","aepic.dll","kernel32.dll","gdi32full.dll","bcrypt.dll","uxtheme.dll","propsys.dll","wintrust.dll","imm32.dll","gdi32.dll","shell32.dll","powrprof.dll","ws2_32.dll","atl.dll","System.Xml.ni.dll","KernelBase.dll","msvcp_win.dll","System.Data.ni.dll","userenv.dll","gpapi.dll","msvcrt.dll","rpcrt4.dll","shlwapi.dll","profapi.dll","System.Core.ni.dll","System.DirectoryServices.ni.dll","combase.dll","windows.storage.dll","System.Data.dll","cfgmgr32.dll","System.ni.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","ole32.dll","msasn1.dll","dhcpcsvc.dll","mscoreei.dll","psapi.dll","Microsoft.Management.Infrastructure.ni.dll","nsi.dll","amsi.dll","crypt32.dll","advapi32.dll","ucrtbase.dll","version.dll","Microsoft.PowerShell.Commands.Management.ni.dll","authfwcfg.dll","ntasn1.dll","dnsapi.dll","dot3api.dll","wshelper.dll","WinTypes.dll","System.Transactions.ni.dll","sstpcfg.dll","rtutils.dll","rasapi32.dll","cabinet.dll","rpcnsh.dll","fwbase.dll","Wldap32.dll","polstore.dll","dhcpcmonitor.dll","netiohlp.dll","icu.dll","sppc.dll","ifmon.dll","eappcfg.dll","msisip.dll","MpClient.dll","rasman.dll","wwapi.dll","httpapi.dll","nshwfp.dll","dot3cfg.dll","winhttp.dll","coml2.dll","netshell.dll","p2pnetsh.dll","fwpolicyiomgr.dll","tdh.dll","WwanPrfl.dll","P2P.dll","AppxSip.dll","secur32.dll","FirewallAPI.dll","eappprxy.dll","winipsec.dll","slc.dll","mobilenetworking.dll","hnetmon.dll","netprofm.dll","mprmsg.dll","14PT7uWe.dll","clrjit.dll","FWPUCLNT.DLL","mfc42u.dll","wcmapi.dll","onex.dll","pwrshsip.dll","mprapi.dll","nettrace.dll","System.Transactions.dll","nshipsec.dll","ktmw32.dll","vcruntime140_1_clr0400.dll","fwcfg.dll","nshhttp.dll","activeds.dll","prxyqry.dll","adsldpc.dll","PeerDistSh.dll","wldp.dll","Microsoft.PowerShell.Security.ni.dll","mfc42.dll","WcnNetsh.dll","wevtapi.dll","NetSetupApi.dll","winnsi.dll","wlancfg.dll","wlanapi.dll","whhelper.dll","wwancfg.dll","wshext.dll","System.Configuration.ni.dll","rasmontr.dll","ncrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Runtime Broker.exe","sha256":"6ccd0a0a3451e942c17e539e104ddc0356c00f605c218bd3d43bdfcd8fa53c37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"StartupProfileData-NonInteractive","sha256":"ca23bde7af5261f542f0e6ca4de9cd5a2fb297216347f714dc4358ae205e5348","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"state.tmp","sha256":"a0f04596c1357ff816e92610f77f748b93f7b6a3aaf2a7e3dd3933cf91347343","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"ModuleAnalysisCache","sha256":"3614976a0875d8943a9e10941946d757873db55b2a8f98991765020592edac0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_0i4zadqm.w3e.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_14wouokx.t5s.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_1poc4tvb.hcw.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_3jdt2r4i.1gn.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_3mk1eimc.wro.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_3new0vok.i2d.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_4op2dsw3.131.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_4prt3bqw.g0v.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_52anat1j.oel.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_5ivjeloe.rxv.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_a1paeq1o.bgx.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_a2mvzrqj.bia.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_arfkdxyq.xbh.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_b4zj0thp.scd.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_epfgjbju.le5.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_j3agjrnl.4ka.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_jm5acwuo.22u.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_moumgk4c.cbd.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"__PSScriptPolicyTest_wgybt01p.udx.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdate.dll","sha256":"94366612b363ac3e175368cc11aa58fcafadc4d9e324c801f696f8a86bcddb39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"psmachine_64.dll","sha256":"2d2cf4ef96ae3ea8eda099e8d50e3bfc4bd638d2629bd6b1cae1c92ca9aa5632","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"psuser_64.dll","sha256":"0b441c41de224692e89e005a3d1d5135a9568465d239d61dc0ac1dd2ab549959","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"psuser_arm64.dll","sha256":"d6e416d1e3f09d310eb216c214e2def4cd9e3afec1f394696630560148f4ab42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"psmachine_arm64.dll","sha256":"8865d01aae67c2571e75df968a2a2b47cf827920b259bea9df368513dc2b2ed5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"psmachine.dll","sha256":"2055ec023310dc7863871df39d4f69c6c02b8efb5b756401f73f5f398e414ad4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"psuser.dll","sha256":"31b3c910aeac22075af48ffeff27bb93b25184e36e1aabaeb00e0587da1fc44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"MicrosoftEdgeUpdateCore.exe","sha256":"113d781452ea8d2632d50a6c64c4b1728d8d158964c0ea99e6e0b23cc9861d89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"MicrosoftEdgeUpdateComRegisterShell64.exe","sha256":"d5d69fb701c077892a587f3ecbb1010ec0846f5046b05a653a7994154420c328","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"MicrosoftEdgeUpdate.exe","sha256":"1fc205aa1c587cad5604c7294165ca01cb5284d998e426cf6d6dca6f7f9f7bdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"MicrosoftEdgeComRegisterShellARM64.exe","sha256":"8666d49f5af22615eacbb8b389098c2e7276e6040c937aba970a1dd46fefa7d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"MicrosoftEdgeUpdateBroker.exe","sha256":"4b117aac83171ff6054822e68a0d479a07a5e54092e7784c1f4d868e690601c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"MicrosoftEdgeUpdateOnDemand.exe","sha256":"14c8378c2feab0fe9c5e856053a0acd4dd43c49ae697a0f46cb72a5b9592f946","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_de.dll","sha256":"d97203d6a65b7069423228c962639a9b8772588515baf875ff3f4a3f5bc78726","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_el.dll","sha256":"e8187fea1b82843af60eae0e49ba184e05d36f112024c029fa0125c5d7067a64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ml.dll","sha256":"f5679de7da75a40b4125b5eb31d6c466e6180e9567b828f980b14e2dc279cafc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_fr-CA.dll","sha256":"ec194ff30119639d586d6bed4a57fa16cc7d1024f09313c55f54311f123bcb88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_pl.dll","sha256":"a71f5fea057b8f82713d13309e27e4341ab9232fecd84b807dccc29eb1c71869","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_lb.dll","sha256":"8b0f4f465da08fa82d98c8af1cc22716c54818161bc258d763810c1ad4a1dd77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ca.dll","sha256":"9871893788cb63a024923941c1ad02da611e27328745eab33f73b42d62c9eaa8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_it.dll","sha256":"b4d1a7bc6fd4606b7dbc95d817202bd01493205daa10a930e2cc2b18d7604c73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_nl.dll","sha256":"50fd04af639457ff71fd65c7a9522e083c0c5887d3c1f8e37f02f5d6b5524baa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_fr.dll","sha256":"ccdda5523459637f0d7b8766fd282b70c2849185dff5935dc2dce1cac89b0e80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_gd.dll","sha256":"2faa96d51684d46d93bfb700d518144bdb50cbdd73fe18e24a1f47d769cd097b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ca-Es-VALENCIA.dll","sha256":"e9b2d242cef0bf2f10824e9435eaa9cbe196c88c6692c0707bcb532580dafa8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ka.dll","sha256":"95024ee97cbcb460b76eb3914a10f35f87632f5c845700b4479a4238cb2da529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sr-Cyrl-BA.dll","sha256":"911da52fad6e28e21909516519884749c437a5d32633caa1ceb492191415d511","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_es-419.dll","sha256":"a9b4c3aa17f41e577f3d8f47e7b1b0eb57e83a67e14f3b9796a6224f0bf13a9e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_mt.dll","sha256":"edfc3f1d981ecf3c3429f886ea39bd280fde25b2ae26dfcbd47c4c265e7db880","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sr.dll","sha256":"9e1d64dea9800d5e7fd7cce92cc9c4d9cc59206d92b649ca71c9bf6b2ed85e1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_hu.dll","sha256":"6048c07a850c8378268d7331ed804ec2fbbaa0659553382f72a423ff738df9b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_hr.dll","sha256":"6b30deee4522880198b706250c919c4ce2f8b63481489f309b7fe5014ee655d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_mk.dll","sha256":"13101960ca99c29e3ff0929a049f52d8451e9fc51d10c781057d8d3659866819","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_or.dll","sha256":"a5450f75f558f9171a8f92bd615d83a1157142ea8dbb85173347e2f953549140","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_bg.dll","sha256":"f9b9730b97f160b22bb9e5f96c2fe623e4cd1ec8d58b36c05e62b92b6eed29e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_fil.dll","sha256":"36ee1d98a48726048f1db8a34a474bd595d42836ef3c9f45ad8fc7876f6f5782","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_az.dll","sha256":"de0b777c86d95dc5e9d0614ac8a5dc1b559791a2fe11385d3758e6f7021d5cb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sl.dll","sha256":"5f154d074780716d46ab8fe688d53197f7fbb3166ae6ed9cc8f0905671b9c853","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_bn-IN.dll","sha256":"ae58ce60a6171b2fbee56f58bfe6e38f5efe568af13355b1d3f6b6c66e5b7906","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ro.dll","sha256":"5ff054e718ab59ec7f0cc8a4a44117885b9f0c44259932827f8fad21b39ec85a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_bn.dll","sha256":"ff10d60ec3ff0cd35ce090823bcb2fdd18c825d7ee6ce17655431739e219c17e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_kn.dll","sha256":"b77fcf90e7f5381fa319802f434ca5dc9ee6ad0cfead4afe59f3a9dac7445c5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_as.dll","sha256":"1ba80418686eea5fc7ece5d0d4f0dd4bcdda9df6abf5bf0e8bd941ee2972ac7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_es.dll","sha256":"cd0b3d6c02257f25cac07adbc2e04745afa7677e1546de60e445a1e1cde7a2dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_da.dll","sha256":"2dfbb4caa84b3be64aa909d4cf63ff4efa02695d6a378e358943c623dbf2a178","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_uk.dll","sha256":"d2de1eabc5acfffd5486af7515975811cc85c49bbc862573f4da2b0881a71591","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_pa.dll","sha256":"319716e1fb626ecc63d47ef8cf68e42103340c7f298562e011a971a072a676d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_gl.dll","sha256":"b76cf107610560354caee4c9519b3e8a94376394a4abaa32fcec5ab1d83f976d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_pt-BR.dll","sha256":"aa65dd7d1cd7ec4a0c3c267c82822e7ccdd14974900cf0f264ab004f71a0c3a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_eu.dll","sha256":"e9be16e58573ad3a66eac5330eeabde2e6b07d47862a78b4a4552cb04570488c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ne.dll","sha256":"275d04333f6b7571b6f64b2f6276c61420d9f7a086397c5b5c24fe7d8d80faf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_hi.dll","sha256":"5a8471a73dcf56c3e65ef855c6c559ce36a52c40f061902106ed9ee1c80600b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sr-Cyrl-RS.dll","sha256":"ccf4f6e47e025357172033e730318728e88f4a88b038d6913443a33e6fd95e5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ur.dll","sha256":"47c0f472273631f48764dc712ccba5c03e8d92402a25257a0d9b76ba0d6ad658","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_nn.dll","sha256":"fe029fd6bcde35b35c8f35e090e63ad6d3fff47944309c021f15e30bc76ac2fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_pt-PT.dll","sha256":"c4323820ba5e9d17b0f0d5372290f3c23a97735b973e19fcdc02333eee7a96a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_te.dll","sha256":"a319c20eab0daf1c371a2ec324b45ad940ea53f1224245cd93a776fc997bdddd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_bs.dll","sha256":"6eab69d9cf28d403706e0dced218b3bfdce328cfed3103812388734bae98c693","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_gu.dll","sha256":"d598eb005612e0a84ebb5a6b38bb3b963ef10d3c97bc27d6b31d2a5225fc239f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ga.dll","sha256":"9ccb338c76156396388f1bdcdd8ab56dddd3e7d0c9e58ad0d36f749a3edb6ec8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sv.dll","sha256":"96d01658c54de1242b34bc6140fe8686ab751845c0e75a88f0dad3bfdd8511b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_af.dll","sha256":"65f20a53718c547b675f0ebd8ce406ae2dcbe242f50fbb631e0d052befaa1a87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ta.dll","sha256":"bac082bf7a45614a229302e454bc3b872f2b9fbfe3d88eeead03962bce2dee28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sr-Latn-RS.dll","sha256":"77c4c44f1e6fb7ccd525ab5ec744ea5c7cd8eb52eacdeb8a42f83999430a4655","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_lv.dll","sha256":"98db378e75eda360fbcc74e22111aff9771fb707d081915eb46793b5b7eff7e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_kok.dll","sha256":"91ba12d89d5e651f5b70d8d5142f5f9a6de1783a544c71ecdca15d7254fb6121","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_kk.dll","sha256":"2f7b1f2c0193166a5882f51d727967b52f7177e9aa0cad37bdeaf974eec12b64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_cs.dll","sha256":"90eaa4bf9fb360730d5d9567206f0740d77007492725973e4dfd3b934cae13f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_et.dll","sha256":"46a9baf759ff770d2abf7fd7f2dda8b1f3336f3dc477889a93b25a12e839d9d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_nb.dll","sha256":"2b24248ab16567c8fc05c964327707685056ed33c748d497b77083a92141de7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sq.dll","sha256":"e7451ec50ab1c6408e5bc003662ca0cdc007a05b8315617d8a657b0a88b4e5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_mi.dll","sha256":"48572b116d002c6e956353b2dd90be740cbafff702cb48e42bccc8ba3716aa91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_quz.dll","sha256":"c8eab92cd12687f90571d3e7ee9efc0fec6e06b02c510314c2e268e5931b9888","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ms.dll","sha256":"967a6a9ecf0a34aa59a21a6117152604239223391bacf770b85d7be1cca2f7c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_sk.dll","sha256":"40796fb216608852ab040875d669b4f7d4da8e6240c09e7596f63cdd62c6dd77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_cy.dll","sha256":"8dddfa9c3cb4a5f6d756b80c254e2c260cc902bc029e01708bb0828abb7ca0a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_fi.dll","sha256":"3e1325f1f1f95d9fffc554d656720e19499ad8f658b1ebbfd4e4d1623639a6fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_mr.dll","sha256":"c29709e567f89ae6ced8352ca979b6d7b8a90240e7ea37549e13bd5bacfec054","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_tr.dll","sha256":"939d802695606636626ce450fea08074f42234cb4adbfa2e7c29439798ccb535","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_is.dll","sha256":"aa80041ef7b479789fc61cc85c82a340d36ebfe40f849e914ca2a86332167e6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ru.dll","sha256":"d540a45e2e980ef76f71899df7dc48ef17fde26d4bf373c641c7a7cdc083d419","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_th.dll","sha256":"1737be079151c671a1e702eb296fd3e72f68bda70af142c0cc3ef04ae5cb097e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_tt.dll","sha256":"a4d4846295d0cc4f34ac9c8ab9c09a589f762630f5a34a69cb8f01b7578ec41b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_fa.dll","sha256":"3757d9f64dc9050b4b4a880be38c563202f5d4e9d4bf5c6209abfd4392aba906","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_id.dll","sha256":"5351fc8c0e42c1c4e33b5a04c24109398bf5a025ada9379d9a7b408c0623e261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_lt.dll","sha256":"03c74a2122241e6793ecced16a940f8b36935ee952ef45b36299de61d4b90e81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_vi.dll","sha256":"c3b076a207b5303f295a6e23c240ae3ab9866065d036c3aeb375e0504b541a57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_lo.dll","sha256":"d35000bea1d48ff2301376168e8e5a7acf57ff8371f158dbf93b0dfaf053b242","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_en.dll","sha256":"6c9f604468d01e0db22903555ce58fba91b3bc1168057bc3cb0d056c4c785ba9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_km.dll","sha256":"15e79d9ac3c0f75ef5963af2fc8c0fca4d4ce78cd94d6ffa2551726c8ce0d0fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_en-GB.dll","sha256":"1ec5c1132baaf9732b5bc30e6d870d5537e6bf3baf9516f66f4bf0c95c1e8b6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ug.dll","sha256":"98f884a1b1216ca2f8ce082c8a8a1aa1835195c7ca55acbde90466190e2f828f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ar.dll","sha256":"13a26667a4fd42a7d9fe3b61fa5ddf959d93642b051a8ad43ef87d38619cdc82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_iw.dll","sha256":"9d702e95f6d914bef2fcb2a8eb796148f6c25762484ce9f9a29498a84c9890ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ja.dll","sha256":"ee2afb2574f5502f782de600edbac64d14947f40f930eeba2a126d706015f211","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_am.dll","sha256":"5ad20f36db95fabbb0f8c62b94bbd532db8083e0f380191180613bd2579a5481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_ko.dll","sha256":"9089b103d1725f84e6c068d4885695953cc93570251d56427801f0e1d5f9fa57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_zh-CN.dll","sha256":"d505ebf40ee176330cf90f7b714726cab1359ad5194361130c836ea4bf782c27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"msedgeupdateres_zh-TW.dll","sha256":"6a3fece89ebc469831f0af6eba0663d689b4ba8cd6532f2b47cd11283640674b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.AsyncEx.Coordination","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Newtonsoft.Json,13.0.3","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,static,static","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.AsyncEx.Coordination,1.0.2","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,DotNetTor,2.3.3","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,DotNetTor","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Newtonsoft.Json","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.AsyncEx.Tasks,1.0.1","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.AsyncEx.Tasks","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.Disposables,1.0.0","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.Collections.Deque,1.0.0","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.Disposables","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Nito.Collections.Deque","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Syroot.Windows.IO.KnownFolders,1.3.0","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\NetFramework\\BreadcrumbStore\\netcore,Syroot.Windows.IO.KnownFolders","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\TsuAmFlag.txt","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\Runtime Broker.exe","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\tor-data\\lock","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\tor-data\\state.tmp","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_moumgk4c.cbd.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xd5qzb0v.p3w.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4op2dsw3.131.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_0i4zadqm.w3e.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_arfkdxyq.xbh.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_a1paeq1o.bgx.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_b4zj0thp.scd.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_14wouokx.t5s.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_wgybt01p.udx.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_j3agjrnl.4ka.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3jdt2r4i.1gn.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_1poc4tvb.hcw.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_4prt3bqw.g0v.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_knzrpxxa.pnm.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jm5acwuo.22u.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3new0vok.i2d.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_3mk1eimc.wro.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_xueibnxa.1bx.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_a2mvzrqj.bia.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ua3piqfm.ty5.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_52anat1j.oel.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_tar0agvx.0nc.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_5ivjeloe.rxv.ps1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_epfgjbju.le5.psm1","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"},{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"65bf0714173bf788b50f90db"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3900:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6568:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:6356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:6092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:6092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:6056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:3920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:3920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3920:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:7356:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:580:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:6088:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:3404:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7208:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"SM0:7208:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"Local\\SM0:7208:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b0058b9658f1206f083aef"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3440:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3440:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3440:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:3440:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:3440:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:3440:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:4876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:4876:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:4876:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:1332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:1332:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:1332:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5512:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5512:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5512:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:5512:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:5512:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:5512:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:5732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:5732:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:5732:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8448:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8448:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:8448:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8448:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8448:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8668:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8668:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8668:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:8668:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:4496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:4496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:4496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:6320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:6320:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:6320:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:8536:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8536:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:6740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:6740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:6740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:8868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"Local\\SM0:8752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"SM0:8752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4496:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4496:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6320:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6320:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6320:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8536:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8536:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8536:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6740:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8868:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8752:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"65ccaa4c2d580017f30d54a5"}]}]}},"report_ids":{"sandbox_job_ids":["65ccaa4c2d580017f30d54a5","65b0058b9658f1206f083aef","65bf0714173bf788b50f90db"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan/PowerShell Sample ab7608bc7af2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ab7608bc7af2…. Malware family: Trojan/PowerShell. Threat score 100/100. 1/24 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan/PowerShell Sample ab7608bc7af2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ab7608bc7af2…. Malware family: Trojan/PowerShell. Threat score 100/100. 1/24 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ab7608bc7af2c4cdf682d3bf065dd3043d7351ceadc8ff1d5231a21a3f2c6527"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan/PowerShell Sample ab7608bc7af2… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ab7608bc7af2…. Malware family: Trojan/PowerShell. Threat score 100/100. 1/24 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L53","11",{}]]