24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4eb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PowerShell/Agent.DUQ trojan Sample a0d7249a0df6… — Score 92/100 — Hybrid Analysis","description":"Malicious verdict for sample a0d7249a0df6…. Malware family: PowerShell/Agent.DUQ trojan. Threat score 92/100. 3/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd","keywords":["Malicious","PowerShell/Agent.DUQ trojan","malware analysis","sandbox report","threat intelligence","a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd"],"about":{"@type":"SoftwareApplication","name":"a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin","applicationCategory":["powershell","ps"],"identifier":"a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd","additionalType":"Malicious sample"},"threatScore":92,"malwareFamily":"PowerShell/Agent.DUQ trojan","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6b7,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\PROGID") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCHANDLER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\INPROCHANDLER32")26:Ta26,"powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1001530847 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1001538609 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1002505210 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1002515038 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1004788294 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1004796053 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1005061617 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1005069580 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1005827873 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1006619576 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1006628663 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1007270978 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1007279568 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1017631679 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018052301 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018074292 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018082480 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018089661 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018096559 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018103362 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018110116 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018116934 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018123421 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1018129957 [PID: 1784] "powershell.exe" queried SystemProcessInformation at 00000000-00001784-00000C15-1024082401 [PID: 1784]27:Tbad,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "70ae47470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "709d47470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "70a847470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "808ab8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "806fb8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "807bb8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8099b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8097b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8083b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "806cb8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8091b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "808fb8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8086b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8085b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8080b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8072b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8077b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8076b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "8075b8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "808fb8470a020000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "806db8470a020000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}28:T11bb,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "106647470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e06247470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "eGG" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70d348470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70cd48470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0d748470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e06547470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "006a47470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30fd4a470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c00151470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90004b470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "30034b470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "70ff4a470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f0fd4a470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40024b470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50a250470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80a550470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0a850470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50b750470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80b750470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a2ceaac40" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00f54e470a020000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "20a4749c800" "pszBlobType": "RSAPUBLICBLOB" "phKey": "40f14e470a020000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}29:T21d8,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "PuGG"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a07647470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e07447470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "0}GG"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d07f47470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a47479d70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c070e62c0a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a47479d70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "0vGG"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a0a64b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a47479d70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00a44b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00a44b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b09b4b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80a74b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40af51470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00aa51470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747ae70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f0ad51470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747a870" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "c0a54b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747a870" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10a04b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a4747a870" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "40a24b470a020000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "20a47479d70" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "009d4b470a020000"}2a:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acb3f7fe7f0000000000000000000051edaff8fe7f0000000000000a0200000000000000000000befdeea82bc800002a0000000000000040bfe52c0a0200008fecaff8fe7f0000e0acb3f7fe7f0000e0acb3f7fe7f0000000000000000000000000000fe7f0000ffffff7f687d000000000000000000000000000000000000d8cea7f7fe7f00002a0000000000000069c360f7fe7f000031000000000000005c020000000000006002000000000000110001100000000090e09ced3200000003a39ef8fe7f000090e09ced3200000000000000000000002b00000000000000000000000000000020b066f7fe7f0000b43f65f7fe7f0000e0cea7f7 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b0000000000000058000000000000000000000000000000000000000000000000000e00000000000e00000001000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000070d89ced32000000040000000000000010004b3fd701000006000000000000000300000000000000a740d5f5fe7f0000000000000000000000000000000000000000000000000000010100000000000060d8e72c0a0200000a000000000000000000000000000000000000000000000043003a005c0055007300650072007300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000498adf8fe7f00000000000000000000000000000000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a011e02c0a02000000000000000000000000e02c0a0200000090aaed32000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00ce02c0a0200000500000000000000400000000000000010d19ced3200000000000000000000000000000000000000000000000000000000000000000000000400000000000000200de02c0a02000000000000000000000000e02c0a0200000090aaed32000000400000000a0200000000000000000000320000000000000000000000000000000000000000000000ffffffff0a02000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000090aaed32000000400000000a0200000000000000000000320000000000000000000000000000000000000000000000ffffffff0a0200000000000000000000000000000000000040d5e62c0a02000050e49ced32000000c487e62c0a020000409ce82c0a02000000000000000000000000000000000000000000000000000000000000000000000000000000000000d088e62c0a020000e488e62c0a020000d088e62c0a020000feffffffffffffff0000000000000000b204e62c0a020000000000000000000000000000000000000000000000000000e0d19ced32000000320000000000000010d19ced3200000030d19ced3200000000cbe82c (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c000000000000b0bb9ced3200000078224c08cc7f0000501a4a3fd70100001affff7f000000002000000000000000a740d5f5fe7f0000f0c89ced320000000000000000000000d8c29ced32000000e300000000000000a0d2e62c0a0200002b0000000000000060c29ced987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b0000d8c29ced32000000000000000498adf8fe7f00000000000000000000000000000000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000006018e02c0a02000000000000000000000000e02c0a0200000090aaed3200000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00ce02c0a0200000500000000000000800000000000000050b49ced3200000000000000000000000000000000000000000000000000000000000000000000000800000000000000a014e02c0a02000000000000000000000000e02c0a0200000090aaed32000000400000000a0200000000000000000000760000000000000000000000000000000000000000000000ffffffff0a02000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000090aaed32000000400000000a0200000000000000000000760000000000000000000000000000000000000000000000ffffffff0a0200000000000000000000000000000000000040d5e62c0a02000090c79ced320000004871e62c0a02000050dde82c0a020000000000000000000000000000000000000000000000000000000000000000000000000000000000001072e62c0a0200002872e62c0a0200001072e62c0a020000feffffffffffffff00000000000000000004e62c0a020000000000000000000000000000000000000100000000000000000000003200000030e7e82c0a02000010000000000000007f0300003200000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000050ad9ced32000000b4304c08cc7f0000b0dd4b3fd70100002cffff7f000000003200000000000000a740d5f5fe7f0000000000000000000000000000000000000000000000000000d100000000000000d088e62c0a0200003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e016e02c0a02000000000000000000000000e02c0a0200000090aaed3200000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00ce02c0a0200000e00000000000000b000000000000000f0a59ced3200000000000000000000000000000000000000000000000000000000000000000000000b00000000000000e016e02c0a02000000000000000000000000e02c0a0200000090aaed32000000400000000000000000000000000000009c0000000000000000000000000000000000000000000000ffffffff0a02000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c00000000000020a69ced32000000ce374c08cc7f0000b0e2493fd701000037ffff7f000000003d00000000000000a740d5f5fe7f0000f0a59ced3200000010a69ced320000000000004e02000000c600000000000000f085e72c0a02000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000006015e02c0a02000000000000000000000000e02c0a0200000090aaed320000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00ce02c0a0200000600000000000000c000000000000000c09e9ced3200000000000000000000000000000000000000000000000000000000000000000000000c000000000000006015e02c0a02000000000000000000000000e02c0a0200000090aaed32000000400000000a0200000000000000000000ae0000000000000000000000000000000000000000000000ffffffff0a02000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000f09e9ced32000000ec3e4c08cc7f0000b0b04b3fd701000040ffff7f000000004600000000000000a740d5f5fe7f0000c09e9ced32000000e09e9ced320000000012e92c02000000bd000000000000000007e72c0a0200005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000202020720000000000080989ced32000000ffffffffffffffff0100000000000000ac989ced32000000000000003307020233072e0000000000f50000000000000000000000000000005c7165dad95600002100002100000000ca00cc0000000000ffffffff000000000004000000000000983cacf8fe7f000080979ced3200000080989ced32000000ffffffff00000000000000000000000080979ced32000000e674d4f5fe7f00007f0000000000000000040000000000000000e02c0a0200000090aaed3200000080989ced32000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff0a02000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000090aaed3200000080989ced32000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffff0a0200000000000000000000000000000000000040d5e62c0a020000d0aa9ced320000001889e82c0a0200006008e92c0a0200000000000000000000000000000000000000000000000000000000000000000000130000000000000098000000000000009894e82c0a02000050dfe62c0a020000feffffffffffffff21000000010000005405e62c0a0200008000000000000000130000000000000000000000000000000000000000000000d400000000000000570069006e0064006f0077000000000018e8ffff (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ff97e82c0a020000a000000000000000ff97e82c0a020000a479e32c0a020000db000000000000000200000200000000010000004d006900630072006f0073006f006600740000000915001c0a020000d749fdf4fe7f00000000000000000000d0d6e82c0a0200003d00003d00000000f0b59ced320000000915001c0a020000a0000000000000000200000200000000fec0a9deccab00000000000000000000000000000000000000000000000000000035f9f4fe7f000040e1e82c0a020000d667adf8fe7f0000a00000a00a0200006287d6f5fe7f00000915001c00000000db000000000000000000000000000000ffffffff0a02000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aadf8fe7f00000000e32c0a020000000000000000000000000000000000000000e32c0a020000dedea9deccab0000d667adf8fe7f0000efbe000000000000588ee62c0a0200004086e62c0a020000588ee62c0a0200000000000000000000b820e92c0a020000b8b49ced32000000b49df8f4fe7f000050cce62c0a020000d667adf8fe7f0000ffffffff0000000020ace82c0a0200000000000000000000000000000000000001000000000000000000000000000000801fe92c0a0200009c96f9f4fe7f00006046e82c0a0200000c00000000000000080000000000000031d40ef7fe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aadf8fe7f00000000e32c0a020000000000000000000000000000000000000000e32c0a020000dedea9deccab0000d667adf8fe7f0000efbe0000000000002888e62c0a0200004086e62c0a0200002888e62c0a0200000000000000000000c822e92c0a020000b8b49ced32000000b49df8f4fe7f000050cce62c0a020000d667adf8fe7f0000ffffffff00000000a0a9e82c0a02000000000000000000000000000000000000010000000000000000000000000000009021e92c0a0200009c96f9f4fe7f00006046e82c0a0200000c00000000000000080000000000000031d40ef7fe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aadf8fe7f00000000e32c0a020000000000000000000000000000000000000000e32c0a020000dedea9deccab0000d667adf8fe7f0000efbe000000000000188ce62c0a0200004086e62c0a020000188ce62c0a0200000000000000000000d824e92c0a020000b8b49ced32000000b49df8f4fe7f000050cce62c0a020000d667adf8fe7f0000ffffffff0000000030b0e82c0a0200000000000000000000000000000000000001000000000000000000000000000000a023e92c0a0200009c96f9f4fe7f00006046e82c0a0200000c00000000000000080000000000000031d40ef7fe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001784) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996aadf8fe7f00000000e32c0a020000000000000000000000000000000000000000e32c0a020000dedea9deccab0000d667adf8fe7f0000efbe0000000000002888e62c0a0200004086e62c0a0200002888e62c0a02000000000000000000007850e92c0a020000b8b49ced32000000b49df8f4fe7f000050cce62c0a020000d667adf8fe7f0000ffffffff0000000030a6e82c0a0200000000000000000000000000000000000001000000000000000000000000000000404fe92c0a0200009c96f9f4fe7f00006046e82c0a0200000c00000000000000080000000000000031d40ef7fe7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00001784)2b:T962,"powershell.exe" queries volume information of "C:\" at 00000000-00001784-00000C17-1002299762 "powershell.exe" queries volume information of "C:\" at 00000000-00001784-00000C17-1002317277 "powershell.exe" queries volume information of "C:\" at 00000000-00001784-00000C17-1002321551 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001784-00000C17-1005311587 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001784-00000C17-1005968027 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001784-00000C17-1006000874 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001784-00000C17-1006505540 "powershell.exe" queries volume information of "C:\" at 00000000-00001784-00000C17-1006798487 "powershell.exe" queries volume information of "C:\share" at 00000000-00001784-00000C17-1006800226 "powershell.exe" queries volume information of "C:\share" at 00000000-00001784-00000C17-1006882189 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001784-00000C17-1010332913 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001784-00000C17-1010468357 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001784-00000C17-1010513635 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00001784-00000C17-10175345842c:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2d:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")2e:T3128,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00001784) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00001784)2f:T967a,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001784) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001784)30:Tc29,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]31:T2818,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffef5d10000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffef5d10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffef5d10000 "powershell.exe" loaded module "KERNEL32" at base 7ffef7030000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffeed980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffef3480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffef4eb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffedf8b0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffef7030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffef11e0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffef5f80000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffef8ab0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7ffee7a90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffef5b30000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffef6770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffed6160000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffef6df0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffef4e20000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffeeb560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffec73a0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffef68a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffef5d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffee2b90000 "powershell.exe" loaded module "NTDLL" at base 7ffef8ab0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffef6a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffec5da0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffef70e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffef6a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffef72c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffec5130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffec46b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffecf820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffef4240000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffec2640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffef6a30000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffef6a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffef7430000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffef7550000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffef5bb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffef5bb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffef57a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 7ffeed960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffeeb560000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffeed940000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffef57a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\M3008PM2.DLL" at base 7ffed4140000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffec25a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffec2430000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffec22c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffec1a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffed3e30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffec10a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffec0d30000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffef5d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffec0be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffec0b70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffec0a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffec0950000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffec0900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffeeb670000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffef4d00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffef3e60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffec0820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffef7030000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffef4d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffef6770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffef6a30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffebfb10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffeed910000 "powershell.exe" loaded module "OLEAUT32" at base 7ffef72c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffebf8d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffebf760000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffef899000032:T5a0,file/memory contains long string with (Indicator: "New-Object"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") file/memory contains long string with (Indicator: "Write-Error"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") file/memory contains long string with (Indicator: "Write-Warning"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "SMHVCWZ8KKAWW5CAYWUB.temp") Found string "Write-Error "Base64 decoding failed: $_"" (Indicator: "Write-Error"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "$outputBuffer = New-Object byte[] $cipherContent.Length" (Indicator: "New-Object"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "Write-Warning "Decryption process failed"" (Indicator: "Write-Warning"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "Write-Error "No content to execute"" (Indicator: "Write-Error"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") file/memory contains long string with (Indicator: "Write-Error"; File: "AMSI") file/memory contains long string with (Indicator: "Write-Warning"; File: "AMSI") file/memory contains long string with (Indicator: "New-Object"; File: "AMSI")33:T771,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")34:T4fb,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsEw\)System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsEw\)System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: SMHVCWZ8KKAWW5CAYWUB.temp] Observed system executable string:"%WINDIR%\system32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001784-00000BC0-1005977690] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" [Source: 00000000-00001784-00000BC0-1018046706] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00001784-00000C2E-2687645388]35:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"36:Tf97,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00001784-00000C2B-1002810712] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00001784-00000C2B-1003135417] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00001784-00000C2B-1003256052] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001784-00000C2B-1003351118] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00001784-00000C2B-1003502101] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00001784-00000C2B-1003553743] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00001784-00000C2B-1003606857] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00001784-00000C2B-1003667704] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00001784-00000C2B-1003747161] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00001784-00000C2B-1003789611] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00001784-00000C2B-1003861529] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00001784-00000C2B-1003985402] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00001784-00000C2B-1004111708] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00001784-00000C2B-1004371780] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001784-00000C2B-1004372020] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00001784-00000C2B-1004580124] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00001784-00000C2B-1004618354] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001784-00000C2B-1004823103] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001784-00000C2B-1004960880] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00001784-00000C2B-1004998067] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00001784-00000C2B-1005082222] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00001784-00000C2B-1005196287] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00001784-00000C2B-1005359364] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00001784-00000C2B-1005585298] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00001784-00000C2B-1005674967]37:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)38:T740,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.MICROSOFT.POWERSHELL.CONSOLEHOST.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.MICROSOFT.POWERSHELL.CONSOLEHOST.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "")39:T642,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "6906E6E1-F9CD-5B3B-C846-27578FD8D69E"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: "NAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: "APPLICATIONBASE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "")3a:T633,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\users\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\music\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\links\desktop.ini" "powershell.exe" reads file "c:\users\%osuser%\saved games\desktop.ini" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config"3b:T4f9,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SMHVCWZ8KKAWW5CAYWUB.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1ef673.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\SMHVCWZ8KKAWW5CAYWUB.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1ef673.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"3c:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"3d:T99a,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SMHVCWZ8KKAWW5CAYWUB.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SMHVCWZ8KKAWW5CAYWUB.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"3e:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00001784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00001784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00001784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00001784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00001784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00001784) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00001784)3f:T11a4,file/memory contains long string with (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") file/memory contains long string with (Indicator: "base64"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "momKUKa0qEh/BXhyQHlKX6IGv2tYaGZ3Z2gqd+fIobzCiJt+goepTAEsYV9bf3hm" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "maeaE+mepnI/KHNHdHhacYwBu0ZLZlp3QW8nFNbLw5GZh6Aes4uZKQY2d0NTfVhX" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "vAeGe0RvVRZSdCl/3OGEgZGLmUSolaZcZCtIAFN/AESQEYtjFHhaa1RlAxekw5qV" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "3/ffF/3h/Sh7SgEBARwDBdZzwBIOExIOGhpsdaesx/Xf/MYL6eT9KH1THAkAHAQA" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "3/LfF/3h/Sh7SgEBARwDCNZzwBIOExIOGhpsdaesx/Xf/MYL6eT9KH1THAkAHAQA" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "3/3fF/3h/Sh7SgEBARwEAdZzwBIOExIOGhpsdaesx/Xf/MYL6eT9KH1THAkAHAQA" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "3/XAC+H94Ch5SgEGAhwDB9Zw3Q4TFQ4TExZsdaeswvff9N8W4OP9KH1UHAMHHAMB" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "w+jCFuP94C95SgMHHAMBHMtywBMTFg4QExZsdaesw+jC9cEL4OfjNXhRHAMBHAEC" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "wvDfFubp/Sx7SgAcAQECHMt13g4RFQ4REA5xcaesw+jD6MML4ODlNXlWBBwFABwA" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "wvXfFuT94DV7SgEAHAAcA81v3RMWDhMXGw5xdaesw+jC9cEL4ODlNXpQBRwBAwIc" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "x/LfF/3h/SlnVwQAHAAcANZy2w4SDhMQFA5ydaeswujD6McL4+P9K35SHAEcAQAc" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "yvffFv3h/S9nVAIcAgUEHMlv3RsOERAOExVsdaesx/Df9cYL4f3gLmdUARwEABwG" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "yvffF/3h/StnUgAcAQMBHMpv3A4TEg4WEg5xdaesw+jD6MIX/eDoNX9KAQccBBwE" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "xejBFf3g4CBnVwEBHAEBA9Zy2Q4TFQ4TExtscaeswfbD6MIT4P3jK31KAQUIHAMJ" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "wvLHC+Dj6TV6UgIcBgYcAsp7wBMTEw4TEA5ydaeswfXf8N8V6P3iLmdXBgAcAQYD" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "y+jCF+X94y1/SgMCHAIECNZ22w4QEg4QEBdscaesxujB9MsL4OTgNXpQAhwCBAUc" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "wfzfFuXh/St4XxwBAgEcBcxv2Q4TFxQOEBZscaesx/zf9cIU/eXnNXheHAUBHAEA" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "wfDHC+ni/S17SgkcAQUJHMt73w4QEREOERBscaeswvDF6MES4f3oIWdXBQEcAQUG" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "3/PCC+Do6DV6UwccBgQcAc96wBESDhMVGw5ydaeswv3f88UL4OfoNXpRBxwCBBwI" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "yvLfFuDi/ShzURwCAAUcAc56wBQbDhMUGg5xcaeswvDD6MQf/eTpNXlWHAMHHAIB" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "xujAEP3j4CtnVAIJHAEFCdZ32Q4aEA4TEBpscaesxPXf9cEX/eDnIGdXAAgcAQgC" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "wfDCC+Dh5zV4XhwCAwMcAcl3wBMXGg4WFg5ydaeswvzC6MEU/eDgIWdXAAgcAQME" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin") Found string "x/XfFeXm/St5VhwHBBwBCctv2xUOExQOGw5xcaeswfDF6MIU5/3jLHpKBRwBAwYc" (Indicator: "aes"; File: "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin")40:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")41:T45d0,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL!^ @ @`Kt H.textd `.sdata@.rsrct@@.reloc @B@Hwj<0}+ (C<&- 8Y( ( }~ ~ ~ ~ o'9 (Js z <( 4X( ( 95~{o9 4(Js z80~{o9 p(Js z) ~{ X( o9 (Js z 95~ { ( o#9 (Js zPX( TX( ~{ ( 0@o~ ( 9 ((Js z~{ o9 ^(Js z X X( 8 X( X( X( 9^i( ~{ ( X( io 9 (Js z (X X!!:O( ( ~{ X( o""9 (Js z(X( ,( X##95~{o$$9 (Js z80~{o%%9 *(Js z~{o&&9 r(Js z[&{''9"{( o &((9X )):*A46N=!Jr+ ((i&-(~(" *0M+ ( 1&-~# 9"rp( o# s$ #~#8*0+ (JM`Q&-~$ 8*Z+ (hn0&-$*0+ (7~Z&-~% 8*n+ (h&-(~(% *+ (uZfl&-(~s4(& t%*0r+ (DvMk&-(~ (J (J(+t (J (J(+t (J (J(+t (J &(J(+t (J T(J(+t (J x(J(+t (J (J(+t (J (J(+t (J (J( +t (J (J( +t *+ (\TQ&-(~ (J(+ (J(+*0+ (^g:&-o (J( 9 ~ 82o (J( 9 ~ 8 (+ (,( (! 8*0t+ (ԈYi&-~& Xo' o( 8: ~&o) Xo* t2(+ to, X i?*j+ (:gW&-(~(" *+ (>q g&-(~( o# o- &*0+ (_ n&-:( o# 9@)%G(. A'5(<@)~ =~ * 8623s/ ;+j -.j4>/7B~ ?0s0 1(1 &* >+ ($ld&-*0 + (~=&-) iZ ]Y X ] : ij \nXjXmijjZ8Xi?i%q `ҁ8$njYYZ?_d j_ҜY=iZ \ #Eg ܺ vT2 8K b8>dXXbXXb`XXb`X`X=D (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (@ (A (A (A (A (A (A (A (A (A (A (A (A (A (A (A (A !(B "(B #(B $(B %(B &(B '(B ((B )(B *(B +(B ,(B -(B .(B /(B 0(B 1(C 2(C 3(C 4(C 5(C 6(C 7(C 8(C 9(C :(C ;(C <(C =(C >(C ?(C @(C X X XX X \D (2 (3 (2 (3 (2 (3 (2 (3 *+ (D>T&-K_f_`XX~AYX(DXT*+ (~f&-K_f_`XX~AYX(DXT*+ (>K&-KaaXX~AYX(DXT*+ (*jP&-Kf`aXX~AYX(DXT*~+ (ٚCa&- Y_d_b`*+ (ZK&-~':(G'~5*0R+ (YU&- (E9s4 8+s5 &r?prp(6 o7 t< *%0 0$+ (t9&-(8 5&*+ ([&-(E:s9 (: *(?*f+ (W&-rJpo; *0L: + (ˇI6&- s58X 8 9Y i5: 58 s -X 58, 6Y 8y 0Y 8` O X %58G 0 X c8*, FY 8.85 8, c58(i] '585:Q8, X g8 .X M8 8Y 8i8`5 S58P, 584, X8, 8& s55E (fH$'*(( g$*X#% 0$){'\{)j^'H+7&\)!_ %'k>,F,* ., %#H%t $R-[*g}") !n #|#8"b$ - O! >] _%'!# *#& {@(l,w'8rY "bD(- 2@#0Q Z&*+zo,w+*-'F)B* *1-\_-!O+%x&x!% $[.% "0: '- Ho , v@ Z{&$"5b % *)@a+(L'#9n# 4 &)PC'E#Q(&D -#*=> Wd)Y&l=&2K@G%DF'e 0- |%Y \+ +(u $y"@7!5}$-% {I-$$o_[XZ+s3 '*~-L"i(! d"S? 6Mp +++^n!#;eL )I)+pl_- 8I 6581283.! &58 DY 8 Z X H8 Y )8 : 5X 5: > SX p8 +Y 8l K8g \X 58\-9|8< + X N58 jY 5: NY 8 RY t8(i[ 58 \X 8 2X @8w m -X 8f _Ҝ ^8N, /8. I #X 8 1 bX d58, MY 58+:i[ `8 X 8. 8. 59 KY 8d>g I8Z!8y+ 8A, 81 yY 8. 5: r58. f8, 58, { IX 8 v58w* :8m L HX 58 . iX 88 a 8 `8 < X )58Y%9 8 ((iXY` 5885% 8o, 59V, 3Y 592 1Y T8 X g5:, 858$9% [58, 8, n88`$2 {58 R58j, ?8V, 86 KY z8% Q58#9i8, 6Y V58#:, ,8 a cX ;8& 58 ] {X 48t8W#8\#i8`#( 8T, 5:;, 58%#9. O8 1Y 8 s kX 8, C ,X C58 tY8.& 8 r5:p @ w5:Z, 5:=(i >5:#, 8, HY P5:%.i?z 828!@ G8, 58!: a8 q ,X 58f, 58n!98@1b1 N84 X1_&_dҜ b8 0 GX8,!81!9\& 8, Y 8 X _dҜ ,58, 9Y B58. 58x, CY 58 9L 5X T8/ 1Y 8, KY ~8 Z X 8 l X *5: 1 7X x58 u CX 78~, IY 58_, Z8K, ^ TX 58p98X 5: EY 58798 4 |X l589 :Y 8, AY 59x, k QY 8U 5:G 1 8:, w UX 88 .5: n `X 59, QY j8 Y58, -Y v8, 8f, 58N** Y'F/ h: >g |3 E? 3 _Z3dY3 U/ _Z/dY/ !ZX3Zn''j`'Zn'^mdb`/a-- _0- _--d0b`3/X3db`/a$$ _$ _$$db`daXba3XdaXbX3aXvlmX* q58:8z L58i, 8U 5890 f RX 8, J8 59 Q 4X i8 tY z58$: LY m8, S59k, 589J G BX <8', 8 $X 5: p8, 58, 8 ?Y A8 CY 58 98n 8R, 5Y 8; MY 8, 58:8, 8, (58d:, o8 CY "584:8z 8f, X 8G rY 5:% KY H58:8, RY 8> 5: R58 58 IY 8 ? $8 b58 589, h8 |X l8x, 9Y 8a 8X 38@ EY 58' X _dҜ \58:88j8 |8, X 58:@ ;5:, 8 3 nX 58q 5:T. 58> Y _X 8) lX 58 TY 58 58 uX 8 /X 5:~9r~p88 f58n Y@I 5:T X 787i>] 8# b +88 ]# 58 2 X 8 .Y 589* 58 3Y 5: u59X O59 \59s T CY D8P ] qX 87 yY 58 8 eY 8 L hX #8 CY y589~988 8 18u }5:\ ;Y y8? =Y 8 8 l X <8. 5889X "8 }589h89 58, I #X 8t, NY Q8UXbXb`Xb`` 58 , J8, [ 3Y 18 - jX 8, B X 8 A8 59|, 5:_, *58C%X% 87, u zX |58t9, 8 V GX 98 , Y ~58%9 2Y 589 q EX k8u a k58 9W BY 8B Y X @58 :8, 8, TX M5: X 058 LX 8, ( AX ?8, 8{, 58[28 ]8F, JY 58' 8, { iX e8, AY 8 SY V59 258 MX 8| *Y 58[&X& 68G 8 WX -58:) X 8, 8, 5:? 588> 58.8L 8 BY #8 X8c8{%%.%aҜ _8K AY 58 98 , 1Y =58, 58 : r X 58, % *X %58d :r8 FY B58A :8e 8Q, iX +58* ;X 8 , 8 EY s8, 4 yX 58 558} 9U8, 8 SY E58H 9] ^ 58, j Y F58:8 8 , 8 9Y =58y, 8e i X Y58L: 84, PX E8 Y@ 58, EY t589T8 bX 8, 8 a hX 59z, 59], 8A QY m8( 0Y 58 ;Y 8~@( 5: o8 { X U8 8Y G8 -Y $8, -Y '8Z 58B JY 8%, .8 W589t8 :X -8(Xb(Xb`(Xb`(` 8 3Y 8, 8h +X 5:NX 38:, 8" q5869 _8 6Y (8~@i: 8 g $X 8 K8 s #X 8t s wX 8c8~@X8888(o8(n8)&rp*)*(h8(q88(b8s< 8(p8(p8(j8}(m8(p8(i8(p8(p8(p8!(q83(p8K(p8(p8T(q8(p8(p8(f8(q8]s= 8(p8(p8@(^8(`8(a8(q8(k8(p8<(p8(q8(p8(q8c(q8(p8(q8(q8(q8M(p8(q8(p8(q8^(p8(q8(q84(l8(q8p(q8(^8(_8(p8?(]8ss> 8n(q8'(q8 (g8(q8(d8(e8(q8(p8(q8(q8(q8(q8(q8I(l8(p8((c8(p8(p8W(q8(q8(p8y(q8(q8p(q8(q8"(q8(p8(p8(q8*6>600 + (i@&-rpo? &(@ (A ioB *B+ (6O&-*0 + (^C9&-(1 &*0e+ (rg"<&- ( rp ( ( (C oD t**0+ (GeZ&-t.oE (F 9t.oE &t.oG oH oI r**0B+ (r4d&-rp o; >**0B+ (+T&-rp o; >**0B+ ()3&-rp o; >**0B+ (f&-r0p o; >**0B+ (c\@&-rdp o; >**0B+ (iJ&-rp o; >**0B+ (8] S&-rp o; >**V+ (1i&-(" *r+ (L.U&- oX *b+ (PO&- oY *r+ (6k&- oZ *b+ ($A&- oO *r+ (R?&- o[ *b+ (ak&- o\ *f+ (kB6&- (] *b+ (EV79&- oG *b+ (wc&- o^ *V+ (CWW&-(F*r+ (%B3&- o_ *+ (_P<&- o` *+ (]M5&- oU *b+ (Eb&- oa *b+ (=dQ&- oW *b+ (Nj&- oV *v+ (5-A&- ( *V+ ()h&-(A *+ (O=&- oB *B+ (G\T&-*B+ (z~7S&-*j+ (9KW&-(~(b *j+ (Q&-(~(" *0+ (/~c&-(A oc %L(. (A oc (H s= (FoR oS od s< ioU oV oW (e *j+ (VW&-(~(" *>+ (52&-*V+ (ruW&-(" **BSJBv4.0.30319p#~#Strings0#GUlD0#US4#Blop4 #GUID:40#BlobW= ^'Nk+ j+Z_f_l_t+_4Mf-+___ _P________/_Y_j_ y___ _ _ '3_ K_ +_0|_000_/1>1>2>D2Ld2R2V3[@3l3u3zmD,n[@n|nn,pAp0qLqhqqrXrrrHs$s/sT7t: tgd|TZw0213 @W @Y GH(IFJfKvLMNE K _ KR ! " # $ % & ' 2G] \\\\\\\\\\ALTERNATECompilationRelaxationsAttributeSystem.Runtime.CompilerServicesmscorlib.ctorVoidSystemInt32BooleanRuntimeCompatibilityAttributeDebuggableAttributeSystem.DiagnosticsDebuggingModesAssemblyTitleAttributeSystem.ReflectionStringAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeSystem.Runtime.InteropServicesGuidAttributeAssemblyFileVersionAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttributef7ec998d-88f7-4e95-a1ef-57e445c96580ALTERNATE.dllGItV314vp8t4yXpncRvP51oJKMlvirFUOeQHObjectEXECUTEp20QqgeuYW4Okv7bKnMulticastDelegateVlFbfuYWP8hoWCiDyBBEXyrBmaHMdVrZ4rrIDpukiPu1vuxuq08KickX0PEqW2TKiwl46svcxqvJYy80U47xWG8UKPx3CkDnLg66ybthFZO3WACw4Vyu15WlrFx68npYo0JTbkHyj2iySH3hekg2M41TvRXcaWtRuNfixdXdg3LxOrHGQUxUS1u3kj7SlOt6qHdZIyhnZtVVpnLGCIQAk10oValueTypeBqjw3ydSVrxKWFT4jjResourcesALTERNATE.PropertiesSettingsApplicationSettingsBaseSystem.Configuration{1DAA42CE-579C-4B68-A31A-BBAF101FC465}HfebT8c5tp3uWZjI4HvHcGgdGK2LA2wTigd8heZdMJUwPGsXDxMQCYyJ1dI6RBxeKEuR9B6gLPLZHGIODLkZBixoDnpg2KA0ffEk6dtoFJbUAttributesoPCO3Nyd2KsLfvcqV`1dhCOEIJp0d5rUgtyRpajxI5VTNJRURPUuLWTAXXQYCAldAvAbeoVLnEqKuwVoc0MVQUi9iidhx7kTG9pAoT18Sqw6WEnumwVXOmOjhR8toQoqwkWafD5fW2WXOcrrhFHB2{0E3AE1BD-7EAC-411D-810D-48ACE9C1F6A5}__StaticArrayInitTypeSize=256__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=18LAUNCHtargetPathByteshellcodeIntPtrInt16TypeGetTypeFromHandleRuntimeTypeHandleMarshalSizeOfZeroInvalidOperationExceptionBitConverterToInt32get_SizeExceptionop_Explicitop_EqualityToInt16BufferBlockCopyArrayGetBytesProcessGetProcessByIdKill InvokethreadHandleBeginInvokeIAsyncResultAsyncCallbackcallbackobjectEndInvokeresultcontextDataprocessHandlebaseAddresssizeallocationTypeprotectdatadataSizebytesWrittenbufferbufferSizebytesReadapplicationNamecommandLineprocessAttributesthreadAttributesinheritHandlesUInt32creationFlagsenvironmentcurrentDirectorystartupInfoprocessInformationfWP88hoWCHDyLB2EXyPBayHMdVrv4rbrIHpuJiP11vuxuB08gKicgXKPEpq2TKiMl4d6svcABvJ7Yy0U4oxWSG8UKP.cctorTQC0YAJ1ds6BaxeKEuc2LiA2wTiLoadLibraryAkernel32ld83LeZdMGetProcAddresswwPkGsXDxYMhnH0S88KQ7illksjDelegateToLowerGetDelegateForFunctionPointerx3CckDng6XybGthFZOI6AUCw4Vuk5WRlrFx6gncIYo0JTJHyfj2iySD3hNmkg2MbTvZRXcaWRRuJNuixdad3TLxOrHqQUAxULnZRVVonLGCISAk910o2qzw3jySVrxcWF2T4jjQku3qkjSlOS6qhHdZIyUInt16YMhHnH088cQ7EillksAifFebT85Sp3nuWZjIbHZBHcGgdfYWu4Okv7ResourceManagerSystem.ResourcesjKnWOlFbfCultureInfoSystem.GlobalizationGIt4V31vpget_AssemblyAssemblyrZPe51oJMXviYrFUOegt4KyXpncSHcm20QqgdefaultInstanceget_DefaultSettingsBaseSynchronizedDefaults9Bx6gxPLModuleY6uahp00wDnS6typemdtFieldInfoMethodInfoResolveTypeGetFieldsMemberInfoget_MetadataTokenResolveMethodMethodBaseCreateDelegateSetValueget_ManifestModuleotUs4SYUodijEM4GuVAciPvw4IH0vh6zdU4NsB5HIkQP49Rb552VZF4jsTIx1Int64nim42BjdmEJ5x4qHGT9UfDM4EDrer8icG4iZHaGbgaQ43dII6kHashtableSystem.CollectionsbN94TRNwQUaYW4AxCdyKGqq4hQUgEWExa4ccsbBVGRh4JiFoCAuTb4FsIUe0pyQ4ZQ7n3NL3K4drvGxnnsd4pSnWDnzIG4oL5ne7SortedListbxb4UOEOYjH7k4fvQUeFuut4H3gTFWYwh4BW5mP4pHe4R0QExQe9h47XeV5MO2B4n9FdxYRuntimeHelpersInitializeArrayRuntimeFieldHandleRSACryptoServiceProviderSystem.Security.Cryptographyset_UseMachineKeyStoreMEwahp0G6pIYuuHGwODLkZUInt64CopyHixVoDnSgAKAD0fEk6ntorFJbUIyPCvO3yd2csLCfvcqVJ7dtlKjo6ztGQeBnUKSymmetricAlgorithmAesCryptoServiceProviderSystem.CoreRijndaelManagedActivatorCreateInstanceObjectHandleSystem.Runtime.RemotingUnwrapoYhMCOEIpCryptoConfigget_AllowOnlyFipsAlgorithmsKd5PrUgtyMD5CryptoServiceProviderHashAlgorithmComputeHashuJR5URPUuget_LengthiWT62XXQYICryptoTransformBinaryReaderSystem.IOCryptoStreamMemoryStreamStreamCryptoStreamModeRldlAvAbeTrimConvertFromBase64StringEncodingSystem.Textget_UnicodeGetStringyVLsnEqKuMVcz0MVQUI9i4Xid8x7GetMethodJTG44pAoT1get_LocationFileExistsGetNameAssemblyNameget_CodeBaseToStringReplaceGetTypeGetPropertyPropertyInfoGetValuegSq4Kw6WJVFileStreamFileModeFileAccessFileShareReadIDisposableDisposeaOm4eOhR8tset_Keyset_IVCreateDecryptorWriteCloseToArrayyQo4YqwkWXtD54mfWWXOprr4uhFHB2fZJ4Wu7mYqofY48xZxPVXCp4LKTVsZt4e4yInfjnusd4bLN7tou5l41JR6K9IyB4gr7XMqV49glPU7bRpJZkkWUdGetManifestResourceStreamSCSti9lqMFSNWR5NpUget_BaseStreaml80KeyMlgEd1skhbI5set_PositionbKRe7tR08wUF1WgiOdHleqwgaBWJt6QtFWftReadBytescjg2l0y8j0fAw4PfrPkvd9Wjuak3MXFQE2N8Reversee26xvjWPsrRic6p0fmCNCeqqXQXeLveMhsewGetPublicKeyTokenyPG3ZEJN3VtP2ju3uPE5CiFKTLw4EGG2w4p8CipherModeset_Modebvu4F9VQQerF7nTP6Ru2fiTT5C8nvAMmttIFAjdqPR6owpdYSekae9FlushFinalBlockU3yScZFEFarrLkl96CnRchQeAZswQ0VWYMtFydjkGBmmQMnkuGWdx0GQj6ibrPA1OwrW6fBxuHN9sZNe2P47YQfX8agJTUEy4dMp8nx9F1tAJZxtRfnx8yrpih6SL9J7dlKjZo69tGeBnUKSlxw4kfJXBFCreateEncryptorToBase64StringclassthiscompinfoflagsnativeEntrynativeSizeOfCodex9Z40NA1HWsVh4agUCaNvalue__WYL4x9lBqfFurahp0zS4Bja$$method0x6000007-1$$method0x6000020-1$$method0x6000020-2$$method0x600002a-1$$method0x600002a-2$$method0x6000039-1$$method0x600005f-1$$method0x600027b-1eLJXfrbZFm550Xef7l.cwVMVYn95fQliWVGfMALTERNATE.g.resourcesaR3nbf8dQp2feLmk31.lSfgApatkdxsVcGcrktoFd.resourcesALTERNATE.Properties.Resources.resourcesGeneratedCodeAttributeSystem.CodeDom.CompilerDebuggerNonUserCodeAttributeCompilerGeneratedAttributeEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateUnmanagedFunctionPointerAttributeCallingConventionFlagsAttribute=ALTERNATE.Properties.ResourcesSystem.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.AesCryptoServiceProvider3{11111-22222-10009-11112}KeLJXfrbZFm550Xef7l.cwVMVYn95fQliWVGfM3{11111-22222-50001-00000};GetDelegateForFunctionPointerfile:///Location3{11111-22222-20001-00001}3{11111-22222-20001-00002}3{11111-22222-30001-00001}3{11111-22222-30001-00002}3{11111-22222-40001-00001}3{11111-22222-40001-00002}3{11111-22222-50001-00001}3{11111-22222-50001-00002}ZGRN&gz\V4 TWrapNonExceptionThrows ALTERNATE Copyright © 2026 )$ecddf8e4-e995-4440-bc07-1eda7d49b6de1.0.0.0M.NETFramework Version=v4.5.1TFrameworkDisplayName.NET Framework 4.5.11*D@y}y D@ D@ D@ $(,04 $ ( , 0 4 y LLLLy y y l M6 !% !- y y 5 y 9= AEI ! ! Q Q &9W@mɳ?3Țjjp$@3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0 eYKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator11.0.0.0 mPLPLZHGIODLkZBixoDn.yJ1dI6RBxeKEuR9B6g+pg2KA0ffEk6dtoFJbU+soPCO3Nyd2KsLfvcqV`1[[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][]N㒥.jۥx3E* X}ͥ|D[wR޿+j ʣ- ۾WmEΜ_}u)ΰQTcfU]4peW<.MԙT;n ds|~/9.=m--s4ɡ7QR#<@HMV^%a1xqk+:Xߟ/ ZT:X-ihh{Z 49&"670AAh"]Pq#}6{ \OK6Ӿ C* 95Cfn{FEyYQJ.΍_۳`]OtjQ/kugo^] DB Nj(H;=;"X:(J26+E}Bǃ>bq폨6]b N5I0F6_1y8y;^+ 65dX{K@^Wv'g~s}XMrLz]V-xb8#+E>A6S{Na8ev]ElvGsW㺆Tw:%6|)ȺiΐLwv`uė0Btw~_pEW-+!ZcX~yo`B6^ú=(͗:^Ad]XD WK?;:ea 52GFX DW!# vJFߤZvcˊGYyZn~&z%%mkT(M_9J@?3+Fqv}PI֛㈹&9r7zPn-L:^xsLfV2rEGg 7Z9S)*u򳿯7ϲ)Q{\2$b'o=)hBeճC3PXٸ1j}(>ĸR#J@}XZZGmǆn ȱ7鿜qQPMvk(6tDჸ9+֟(yh``??U0sj?jK(VCbNw΍DΏΔlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetfSystem.Drawing.Icon, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ajSystem.CodeDom.MemberAttributes, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089mSystem.Globalization.CultureInfo, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089fSystem.Drawing.Size, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3ảcBjCQ+:2SQ}3Bt9%Pi Af= $this.SnapToGrid&$this.TrayLargeIcon$this.Icon$this.Locked $this.DrawGrid ,progressBar1.Modifiers "$this.Localizabled $this.Languagef $this.GridSize* $this.TrayHeight&progressBar1.Locked@QSystem.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aSystem.Drawing.IconIconDataIconSizeSystem.Drawing.Size System.Drawing.Sizewidthheight ( @AISystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089System.CodeDom.MemberAttributesvalue__`B System.Globalization.CultureInfo m_isReadOnlycompareInfotextInfonumInfodateTimeInfocalendar m_dataItem cultureIDm_namem_useUserOverride System.Globalization.CompareInfoSystem.Globalization.TextInfo%System.Globalization.NumberFormatInfo'System.Globalization.DateTimeFormatInfoSystem.Globalization.Calendar System.Globalization.CompareInfom_name win32LCIDculture m_SortVersion System.Globalization.SortVersion System.Globalization.TextInfom_listSeparatorm_isReadOnly m_cultureNamecustomCultureNamem_nDataItemm_useUserOverride m_win32LangID %System.Globalization.NumberFormatInfo"numberGroupSizescurrencyGroupSizespercentGroupSizespositiveSignnegativeSignnumberDecimalSeparatornumberGroupSeparatorcurrencyGroupSeparatorcurrencyDecimalSeparatorcurrencySymbolansiCurrencySymbol nanSymbolpositiveInfinitySymbolnegativeInfinitySymbolpercentDecimalSeparatorpercentGroupSeparator percentSymbolperMilleSymbolnativeDigits m_dataItemnumberDecimalDigitscurrencyDecimalDigitscurrencyPositivePatterncurrencyNegativePatternnumberNegativePatternpercentPositivePatternpercentNegativePatternpercentDecimalDigitsdigitSubstitution isReadOnlym_useUserOverride m_isInvariantvalidForParseAsNumbervalidForParseAsCurrency +- . ¤ NaNInfinity -Infinity %‰ 0123456 7!8"9CQSystem.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3aSystem.Drawing.SizewidthheightPlSystem.Resources.ResourceReader mscorlib Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP&RSDS9G;OHALTERNATE.pdb8N @_CorDllMainmscoree.dll% @xjVp $ν|*ƇGF0FؘiD[\"kqCy!Ib%@@QZ^&Ƕ]/SD!7Ç ZEogL*B9q"am8D꾤K`Kp~('09|eVD")*C#9Y[e}]O~o CN~S5:*ӆHI9@tHHUEx}tJ@]@@QԀcHܟmK>h**D!ny#Ex-URfhn M"v33m M")avX0 0*H 0HX4VS_VERSION_INFO?DVarFileInfo$Translation|StringFileInfoX000004b0Comments"CompanyName< FileDescriptionALTERNATE0FileVersion1.0.0.0 HTTP/1.1 200 OK\nDate: Mon\n 23 Mar 2026 18:06:33 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET\nset-cookie: __cf_bm=8_y8jqsFmH7cbgxORRRxP4r8cKG4wAoKU2BepOJvp7k-1774289193.9821362-1.0.1.1-_inbD20zRt7noA8TLFoRwra5uYFW4J0mC4o52Zf1BCfQDKPKtQ6OVL5rOugIRhI_3B_gH4FnSkTnYNEQp2Nnucyr5rTrIe_u275EBx52gCmj_Xgi4PT4IEIgFK4oNp3b; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Mon\n 23 Mar 2026 18:36:33 GMT\nServer: cloudflare\nCF-RAY: 9e0f5ee66b8d7af7-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$42","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.16.185.241 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contacts Mail Related Domain Names","description":"\"mail.rovagrup.com.tr\" is probably a mail server","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":10,"id":"network-18","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"icanhazip.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"Mail traffic to 94.73.183.154 on port 587 (SMTP)","origin":"Network Traffic","mitre_attack_id":"T1071.003","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"powershell.exe\" with commandline \"-f \"C:\\\\a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin.ps1\"\" (UID: 00000000-00001784)\n Spawned process \"AddInProcess32.exe\" (UID: 00000000-00003080)\n Spawned process \"AddInProcess32.exe\" (UID: 00000000-00005680)\n Spawned process \"AddInProcess32.exe\" (UID: 00000000-00005860)\n Spawned process \"AddInProcess32.exe\" (UID: 00000000-00008052)\n Spawned process \"AddInProcess32.exe\" (UID: 00000000-00008072)\n Spawned process \"AddInProcess32.exe\" (UID: 00000000-00004580)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Attempts to identify external IP address"}],"sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":139,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":25,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":25,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["suspicious"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69c180dc4f29f02ba20f7c02","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":92,"malware_family":"PS.ShellLoader","contacted_countries":["TUR"],"submit_name":"a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin","analysis_start_time":"2026-03-23T18:05:17+00:00","indicators_count":{"informative":118,"suspicious":15,"malicious":3},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.16.185.241","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"address":"94.73.183.154","port":587,"protocol":"TCP","country":"Türkiye","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}],"dns_resolutions":[{"domain":"icanhazip.com","address":"104.16.185.241","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"domain":"mail.rovagrup.com.tr","address":"94.73.183.154","ttl":3600,"country":"Türkiye","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}],"http_requests":[{"host":"icanhazip.com","host_ip":"104.16.185.241:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: icanhazip.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}],"processes":[{"pid":1784,"ppid":0,"name":"powershell.exe","command_line":"-f \"C:\\a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd.bin.ps1\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00001784","icon":"$43"},{"pid":3080,"ppid":1784,"name":"AddInProcess32.exe","command_line":"","sha256":"43e96d4445fa7a451ffe1aa03c8c05df1364be2ec2f05d2cb135690a615af0cb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe","parent_uid":"00000000-00001784","uid":"00000000-00003080"},{"pid":5680,"ppid":1784,"name":"AddInProcess32.exe","command_line":"","sha256":"43e96d4445fa7a451ffe1aa03c8c05df1364be2ec2f05d2cb135690a615af0cb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe","parent_uid":"00000000-00001784","uid":"00000000-00005680"},{"pid":5860,"ppid":1784,"name":"AddInProcess32.exe","command_line":"","sha256":"43e96d4445fa7a451ffe1aa03c8c05df1364be2ec2f05d2cb135690a615af0cb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe","parent_uid":"00000000-00001784","uid":"00000000-00005860"},{"pid":8052,"ppid":1784,"name":"AddInProcess32.exe","command_line":"","sha256":"43e96d4445fa7a451ffe1aa03c8c05df1364be2ec2f05d2cb135690a615af0cb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe","parent_uid":"00000000-00001784","uid":"00000000-00008052"},{"pid":8072,"ppid":1784,"name":"AddInProcess32.exe","command_line":"","sha256":"43e96d4445fa7a451ffe1aa03c8c05df1364be2ec2f05d2cb135690a615af0cb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe","parent_uid":"00000000-00001784","uid":"00000000-00008072"},{"pid":4580,"ppid":1784,"name":"AddInProcess32.exe","command_line":"","sha256":"43e96d4445fa7a451ffe1aa03c8c05df1364be2ec2f05d2cb135690a615af0cb","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe","parent_uid":"00000000-00001784","uid":"00000000-00004580"}],"all_imported_dlls":["win32u.dll","wldp.dll","NapiNSP.dll","wbemprox.dll","winrnr.dll","rasman.dll","mscoree.dll","ws2_32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","m3008pm2.dll","System.DirectoryServices.ni.dll","gdi32.dll","cryptsp.dll","ntmarta.dll","cryptbase.dll","secur32.dll","wbemcomn.dll","FWPUCLNT.DLL","shell32.dll","bcryptprimitives.dll","sechost.dll","SHCore.dll","cfgmgr32.dll","cldapi.dll","rsaenh.dll","System.Numerics.ni.dll","System.Transactions.dll","Microsoft.Management.Infrastructure.ni.dll","winnsi.dll","rasadhlp.dll","rasapi32.dll","System.Drawing.dll","ucrtbase.dll","System.Core.ni.dll","WMINet_Utils.dll","Microsoft.CSharp.dll","msvcp_win.dll","rpcrt4.dll","powrprof.dll","sspicli.dll","srvcli.dll","System.Management.Automation.ni.dll","System.Management.dll","combase.dll","System.Xml.ni.dll","netutils.dll","wow64cpu.dll","nsi.dll","dhcpcsvc6.dll","dwmapi.dll","linkinfo.dll","amsi.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","fastprox.dll","System.Security.dll","clrjit.dll","System.Dynamic.dll","rtutils.dll","user32.dll","IPHLPAPI.DLL","oleaut32.dll","BCP47Langs.dll","imagehlp.dll","windows.storage.dll","ELSCore.dll","iertutil.dll","vcruntime140_clr0400.dll","System.Windows.Forms.dll","Accessibility.dll","ole32.dll","shlwapi.dll","userenv.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","System.Net.Http.ni.dll","msvcrt.dll","cscapi.dll","wmiutils.dll","nlaapi.dll","fltLib.dll","kernel.appcore.dll","mscorlib.ni.dll","crypt32.dll","slc.dll","psapi.dll","System.Runtime.Serialization.ni.dll","advapi32.dll","imm32.dll","wintrust.dll","System.Management.ni.dll","winhttp.dll","propsys.dll","System.ni.dll","ntshrui.dll","msvcp110_win.dll","version.dll","ucrtbase_clr0400.dll","wbemsvc.dll","clrcompression.dll","VxSSL64.dll","clr.dll","gpapi.dll","System.Configuration.ni.dll","dpapi.dll","profapi.dll","mswsock.dll","kernel32.dll","uxtheme.dll","AppResolver.dll","policymanager.dll","dnsapi.dll","pnrpnsp.dll","comctl32.dll","System.Web.Extensions.dll","msasn1.dll","sppc.dll","atl.dll","mscoreei.dll","MpOAV.dll","wow64win.dll","dhcpcsvc.dll","aepic.dll","wow64.dll","gdi32full.dll","bcrypt.dll","System.Transactions.ni.dll","MpClient.dll","System.Configuration.Install.ni.dll","webengine4.dll","System.Numerics.dll","KernelBase.dll","clbcatq.dll","OnDemandConnRouteHelper.dll","System.Data.ni.dll","System.Data.dll","ntdll.dll","urlmon.dll","diasymreader.dll","System.Web.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SMHVCWZ8KKAWW5CAYWUB.temp","sha256":"c6d4da60462db73a3e0f0cc0efa4a823463c077ea6dd504962a624995ea95601","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\SMHVCWZ8KKAWW5CAYWUB.temp","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1ef673.TMP","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_v2k23dno.53b.ps1","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_u1tpkuwj.lqt.psm1","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1784:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1784:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"Local\\SM0:1784:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"Local\\SM0:1784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"SM0:1784:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]},{"name":"SM0:1784:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69c180dc4f29f02ba20f7c02"}]}]}},"report_ids":{"sandbox_job_ids":["69c180dc4f29f02ba20f7c02"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious PowerShell/Agent.DUQ trojan Sample a0d7249a0df6… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a0d7249a0df6…. Malware family: PowerShell/Agent.DUQ trojan. Threat score 92/100. 3/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd"}],["$","meta","4",{"property":"og:title","content":"Malicious PowerShell/Agent.DUQ trojan Sample a0d7249a0df6… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a0d7249a0df6…. Malware family: PowerShell/Agent.DUQ trojan. Threat score 92/100. 3/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious PowerShell/Agent.DUQ trojan Sample a0d7249a0df6… — Score 92/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a0d7249a0df6…. Malware family: PowerShell/Agent.DUQ trojan. Threat score 92/100. 3/27 AV engines flagged this file. 3 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]