26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/Packed.Agent Sample b6f98faaf7e7… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample b6f98faaf7e7…. Malware family: JS/Packed.Agent. Threat score 87/100. 2/26 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b6f98faaf7e7b2efee6a416c060e9fad48941393aa546be03ae417005316bc70","keywords":["Malicious","JS/Packed.Agent","malware analysis","sandbox report","threat intelligence","b6f98faaf7e7b2efee6a416c060e9fad48941393aa546be03ae417005316bc70"],"about":{"@type":"SoftwareApplication","name":"Vessel Details.js","applicationCategory":["script","javascript"],"identifier":"b6f98faaf7e7b2efee6a416c060e9fad48941393aa546be03ae417005316bc70","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"JS/Packed.Agent","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp")28:T756,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp")29:T7a3,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "# valid values (supported on all paltforms where Format-Hex is avali" (Indicator: "Format-Hex"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp, 00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found string "# .{ $i;$i;$i;$i64 } | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp")2a:T880,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004672-00000BC0-1125349507") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp, 00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp")2b:T4ae,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WINMGMTS\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32")2c:Ta0e,"WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1121707378 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1121717263 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1122168138 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1122177253 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1122351638 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1122361127 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1123317169 [PID: 3244] "WScript.exe" queried SystemProcessInformation at 00000000-00003244-00000C15-1123325348 [PID: 3244] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1124214531 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1124222660 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1125738021 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1125746654 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1126513613 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1126522753 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1126929663 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1126952928 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1127201716 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1127209939 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1127842162 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1129194843 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1129204130 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1129683305 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1129691575 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1131044365 [PID: 4672] "powershell.exe" queried SystemProcessInformation at 00000000-00004672-00000C15-1131053701 [PID: 4672]2d:Td4e,Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp")2e:T516,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Able to perform cryptographic operations Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: The input file contains long Base64 encoded strings Matched sigs: YARA signature match – Encryption algorithm2f:T162d,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac5ac4fb7f0000000000000000000051ed39c6fb7f0000000000003802000000000000000000003a9fa95fffc700002a00000000000000f08dd531380200008fec39c6fb7f0000e0ac5ac4fb7f0000e0ac5ac4fb7f0000000000000000000000000000fb7f0000ffffff7fb015000000000000000000000000000000000000d8ce4ec4fb7f00002a0000000000000069c307c4fb7f00003100000000000000dc02000000000000e002000000000000110001100000000020d06f184e00000003a3e8c3fb7f000020d06f184e00000000000000000000002b00000000000000000000000000000020b00dc4fb7f0000b43f0cc4fb7f0000e0ce4ec4 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000038000000000000000000cc3138020000328937c6fb7f000040000000fb7f00000000000038020000380000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000002010c2313802000000000000000000000000c23138020000b024dc31380200000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000006827dc313802000004000000000000003800000000000000f098e7c3fb7f00003800000000000000380000000000000050956f184e000000c00c7995fb7f000000000000 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0d9a3fb7f0000070000000000000000000000000000000100000000000000f0a5ee333802000000000000000000009050f333380200004c98e7c3fb7f000080e7ee3338020000b3ce6f95fb7f00007051f33338020000004fd9a3fb7f0000d0b0d9a3fb7f0000000000000000000000000000000000007051f33338020000f0a5ee3338020000801df23338020000a8956f184e0000004c98e7c3fb7f00000100000000000000a8956f184e000000801df233380200007051f33338020000010000000000000002bc6f95fb7f0000f052f333380200008092f13338020000feffffff040000007df0d8a3fb7f0000601af233 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0a5ee333802000000000000000000009050f333380200004c98e7c3fb7f000080e5ee3338020000b3ce6f95fb7f0000c055f33338020000384fd9a3fb7f0000d0b0d9a3fb7f000000000000000000000000000000000000c055f33338020000f0a5ee3338020000801df23338020000a0956f184e0000004c98e7c3fb7f00000100000000000000a0956f184e000000801df23338020000c055f33338020000010000000000000002bc6f95fb7f000000000000000000008092f13338020000f052f33304000000fefffffffffffffff0a5ee33380200007df0d8a3fb7f000000000000 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000ec5b6f184e00000010000000000004002caec11558cc0000503a94c5fb7f0000000000000000000098ed98c5fb7f0000c06b6f184e00000020e59fc5fb7f00000000000000000000086a6f184e0000000000000000000000000000000000000030696f184e00000080d077c5fb7f0000c00000000000004600000000000031003200300037003300360031003000300098ed98c5fb7f000070686f184e0000000a36a95fffc7000000000000000000000000000000000000d0636f184e000000020000000000000017d635c6fb7f00009782740661a3000090696f184e000000da34a95fffc700005bca67c3fb7f0000506f6f18 (UID: 00000000-00003244) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000028acff184e00000000000000000000000c00000000000000c000000000000000ac000000000000000000d33138020000328937c6fb7f000040000000ffc700000000000000000000ac00000000000000000000004e00000028a7ff184e00000003000000000000000000000000000000020000000000000000000000000000000100000000000000faffffffffffffff010000000000000030a7ff184e00000058000000000000009af5395fffc700000000000000000000000000000000000040a9ff184e00000028acff184e00000003000000000000008a00000000000000d66737c6fb7f00000000000000000000fffffffffb7f000000000000 (UID: 00000000-00003244)30:Ta42,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000868a7c954deb00004aaaa95fffc70000060000000000000000003369f67f0000a402eca8fb7f00000600000038020000d8f182c3fb7f000050fc6f184e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003369 (UID: 00000000-00003244) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004cf56f184e000000000000000000000000f96f184e000000b88dd5313802000060ef6f184e00000000000000000000004ef7b6c2fb7f00004cf56f184e0000000000000000000000000000000000000099dd82c3fb7f00000000000000000000f0ee6f184e00000000ef6f184e000000010000004e00000000000000 (UID: 00000000-00003244) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bb7c2fb7f0000000079a3fb7f00000000000000000000000000000000000008067aa3fb7f00000001000000000000f098e7c3fb7f000000010000000000000001000000000000000000000000000000067aa3fb7f000001000000000000000f1879a3fb7f0000000000000000000000067aa3fb7f000000000000 (UID: 00000000-00003244) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c316ea1fb7f0000708b70a1fb7f00000200000000000000708b70a1fb7f000000000000000000000300000000000000b1316ea1fb7f0000a81571a1fb7f000050d3cc313802000060d3cc3138020000888b70a1fb7f00000100000000000000239fe9c3fb7f00000000000000000000888b70a1fb7f000006000000 (UID: 00000000-00003244) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303dfa9cfb7f0000c0fefb9cfb7f00000400000000000000c0fefb9cfb7f000000000000000000000500000000000000453dfa9cfb7f0000286afc9cfb7f0000be5ab8c2fb7f00008879ec333802000066247c954deb0000b08eb8c2fb7f0000239fe9c3fb7f00000100000000000000d132fa9cfb7f00000000b1c2 (UID: 00000000-00003244) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000030000000000000000000159dfb7f000000000000000000000000000000000000883f169dfb7f00000001000000000000f098e7c3fb7f0000000100000000000000010000000000000000000000000000803f169dfb7f00000100000000000000bf10159dfb7f00000000000000000000803f169dfb7f000001000000 (UID: 00000000-00003244) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005e21300006027787e (UID: 00000000-00004672)31:T60f,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")32:T499,Found reference to API "[System.Diagnostics.FileVersionInfo]::GetVersionInfo($this.FullName)" (Indicator: "GetVersion"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp")33:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")34:T6d1,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004672-00000C17-1127824824 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004672-00000C17-1128180341 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004672-00000C17-1129076589 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004672-00000C17-1129317856 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004672-00000C17-1130656266 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004672-00000C17-1130793859 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004672-00000C17-1130839166 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004672-00000C17-113310139235:T37e5,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003244) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004672) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00004672)36:Tbdcc,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003244) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003244) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004672) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00004672)37:T9aa1,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp, 00000000-00004672.00000000.137960.7E760000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004672.00000001.138303.1B580000.00000004.mdmp, 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004672.00000001.138303.1D27A000.00000002.mdmp, 00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp, 00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004672.00000001.138303.A3D92000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004672.00000001.138303.A3D92000.00000002.mdmp")38:T1c44,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004672.00000000.137960.7F820000.00000004.mdmp 00000000-00004672.00000001.138303.7F820000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004672.00000001.138303.7F820000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aspnet_compiler.exe" in Source: 00000000-00004672.00000001.138303.7FE00000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004672.00000001.138303.7FE00000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004672.00000001.138303.7FE00000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "HKLM\" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp39:T67f,Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3244:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3244:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:3244:304:WilStaging_02" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:3244:120:WilError_01" Process WScript.exe created mutex with name "SM0:3244:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "SM0:3244:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3244:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3244:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4672:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4672:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4672:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4672:304:WilStaging_02"3a:Tcd3,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]3b:T1e7e,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004672.00000000.137960.03410000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004672.00000000.137960.7E760000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004672.00000000.137960.7F820000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004672.00000001.138303.1D27A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00004672.00000001.138303.7E760000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004672.00000001.138303.7F820000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004672.00000001.138303.7F820000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aspnet_compiler.exe" in Source: 00000000-00004672.00000001.138303.7FE00000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00004672.00000001.138303.7FE00000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004672.00000001.138303.7FE00000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "HKLM\" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004672.00000001.138303.95748000.00000002.mdmp3c:T2d47,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbc2b10000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbc2b10000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbc2b10000 "WScript.exe" loaded module "KERNEL32" at base 7ffbc3820000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffba0d00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbc0ce0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffbc5460000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffbc3820000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffb95980000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffba3e90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffbb9c90000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffba3d80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\84LPOCOM.DLL" at base 7ffb9cfe0000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffbc1700000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffbc5690000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 23833ca0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffbc1ae0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffbae9e0000 "WScript.exe" loaded module "OLE32.DLL" at base 7ffbc5ec0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffbc2750000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffba3790000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffba16e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffb9cfa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffb958e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffbb02a0000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ffb957a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ffbb95e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffb9d150000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb956c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffbc3820000 "WScript.exe" loaded module "USERENV.DLL" at base 7ffbc25d0000 "WScript.exe" loaded module "VERSION.DLL" at base 7ffbb9c90000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffbc6350000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffbc2b10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ffb8d020000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffbb91c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffbb6610000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffbb6640000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffbc2b10000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffbc2b10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffbb6810000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffbc3fc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffbbd590000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffbc2d80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffbbe310000 "WScript.exe" loaded module "USER32.DLL" at base 7ffbc39a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffbb4800000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffbc3fc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffbb7c50000 "WScript.exe" loaded module "MSISO.DLL" at base 7ffbafd80000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffbc25a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffbc2b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffbc2b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffbc2b10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffbc2b10000 "powershell.exe" loaded module "KERNEL32" at base 7ffbc3820000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffba0d00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffbc5690000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffba8d50000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffbc5400000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffbc2710000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffbb9c90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb94ba0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffbc39a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffbc2b10000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffbb4630000 "powershell.exe" loaded module "NTDLL" at base 7ffbc6350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffbc5740000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffbc5460000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffbc3820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb935a0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffbc5ec0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffbc5740000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffbc6080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb92930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb91eb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb91e00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffbc1ae0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffbc29d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb8fd90000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffbc5740000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffbc5740000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffbc6350000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffbc3f00000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffbc3fc0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 21a7f130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb8fc20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 21a7f130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffbc2750000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffba3e90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb8fab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb8f970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb8f0c0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffbc2750000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffbb9c90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffba3d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\84LPOCOM.DLL" at base 7ffb9cfe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb8f020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb8e6b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb8e340000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb8e2e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffbc2b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb8e190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb8e120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb8e040000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb8dff0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffbba040000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffbc25a0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffbc1700000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffbc0ce0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb956c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffbc3820000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffbc25d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffbc5690000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffbc5740000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb8d2e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb8d2b0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffbc1c60000 "powershell.exe" loaded module "ADVAPI32" at base 7ffbc5690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffb8d0700003d:T103e,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Indicator: "Write-Error"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp")3e:T18bd,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TREATAS") "WScript.exe" touched "VBScript Regular Expression" (Path: "HKCU\CLSID\{3F4DACA4-160D-11D2-A8E9-00104B365C9F}\TREATAS") "WScript.exe" touched "XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")3f:Tf93,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003244-00000C2A-1121922051] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003244-00000C2A-1122264562] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003244-00000C2A-1123473442] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004672-00000C2D-1063523576] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00004672-00000C2A-1124994688] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00004672-00000C2A-1125093114] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004672-00000C2A-1125181195] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00004672-00000C2A-1125320986] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00004672-00000C2A-1125374438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00004672-00000C2A-1125431269] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00004672-00000C2A-1125488402] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00004672-00000C2A-1125593453] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00004672-00000C2A-1125636127] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004672-00000C2A-1125710017] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00004672-00000C2A-1125924139] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00004672-00000C2A-1126030336] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004672-00000C2A-1126320304] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004672-00000C2A-1126414042] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00004672-00000C2A-1126745052] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00004672-00000C2A-1126839545] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00004672-00000C2A-1126882217] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00004672-00000C2A-1126931716] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00004672-00000C2A-1127016026] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00004672-00000C2A-1127149278] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00004672-00000C2A-1127280726]40:T7b2,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "function Import-PowerShellDataFile" (Indicator: "Import-PowerShellDataFile"; Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp")41:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")42:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")43:T7ae,"WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\Windows\System32\powershell.exe" "WScript.exe" trying to access non-existent file "C:\powershell.exe" "WScript.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\powershell.exe" "WScript.exe" trying to access non-existent file "C:\Windows\System\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system\powershell.exe" "WScript.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\WINDOWS\powershell.exe" "WScript.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\powershell.exe" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\powershell.exe" "WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\WINDOWS\System32\Wbem\powershell.exe" "WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL"44:Ta3f,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\TEMP" "WScript.exe" trying to access non-existent file "C:\Temp\" "WScript.exe" trying to access non-existent file "C:\Windows\System32\taskkill.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\taskkill.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1"45:T484,"2.5.29.37" "2.5.29.35" "1.0.0.0" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "ystem.Transactions,4.0.0.0,,b77a5c561934e089" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.15" "2.5.29.32" "2.5.29.31" "2.5.29.14" "2.5.29.19" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" "2.5.4.10" "2.5.4.5" "2.5.4.6" "2.5.4.8" "2.5.4.11" "2.5.4.7" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.1" found in string "??\C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1"46:T1cd8,Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "pathext=.com" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "icrosoft.powershell.se" Heuristic match: "icrosoft.powershell.gp" Heuristic match: "icrosoft.powershell.gr" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "vj.com/rep" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Heuristic match: "ust.net" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://www.microsoft.com0" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "https://go.microsoft.co" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623621" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Heuristic match: "9.15.cat" Heuristic match: "15.cat" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Heuristic match: "tion.re" Heuristic match: "t.automation.re" Heuristic match: "stem.management.automation.re" Heuristic match: "0.16299.15.cat" Heuristic match: "icrosoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "w.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "t.com/pk" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.validationtest.contoso.com/test%d.html"47:T544b,Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;prompt=$p$g1.3.6.1.4.1.311.46.3homedrive=c:1.3.6.1.5.5.7.3.8processor_level=6systemdrive=c:systemroot=c:\windows1.3.6.1.4.1.311.10.3.6sessionname=console1.3.6.1.5.5.7.3.3username=hapubwspublic=c:\users\publicprocessor_revision=4f00windir=c:\windowsnumber_of_processors=8system.datahomepath=\users\hapubwsos=windows_nt.1.5.1.2addtrustited1+0)2.5.29.1bhv*8tpa0$0" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]servicex+v" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "https://www.verisign.com/cps04path=c:\programdata\oracle\java\javapath;c:\windows\system32;c:\windows;c:\windows\system32\wbem;c:\windows\system32\windowspowershell\v1.0\;c:\users\hapubws\appdata\roaming\nvm;c:\program" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "https://go.microsoft.co]as(" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ektlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004672.00000000.137960.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004672.00000000.137960.7FD00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004672.00000000.137960.7FD00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004672.00000000.137960.7FD00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;prompt=$p$ghomedrive=c:processor_level=6systemdrive=c:systemroot=c:\windows10.3.6sessionname=consoleusername=hapubwspublic=c:\users\publicprocessor_revision=4f00windir=c:\windowsnumber_of_processors=8homepath=\users\hapubwsos=windows_nt.1.5.1.2addtrustited1+0)2.5.29.1bhv*8tpa0$0" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "https://go.microsoft.copab5" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004672.00000001.138303.7F820000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\users\hapubws\appdata\local\microsoft\windows" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1bm@qc" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://crl.m$vkt7" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://crl.micrm/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0iysxicrosoft" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004672.00000001.138303.7FD00000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004672.00000001.138303.7FE00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004672.00000001.138303.7FE00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010" - Source: "00000000-00004672.00000001.138303.7FE00000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004672.00000001.138303.95748000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004672.00000001.138303.A3D92000.00000002.mdmp")48:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp")49:T8c5,"WScript.exe" called "FindFirstFileW" with parameter C:\Temp\script_uN18mFvvUbu2_1783596220641.ps1 (UID: 00000000-00003244) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004672) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00004672) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00004672) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00004672) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00004672) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00004672) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00004672)4a:T167b,file/memory contains long string with (Indicator: "aes"; File: "Vessel Details.js") file/memory contains long string with (Indicator: "base64"; File: "Vessel Details.js") file/memory contains long string with (Indicator: "rsa2"; File: "Vessel Details.js") file/memory contains long string with (Indicator: "3des"; File: "Vessel Details.js") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004672.00000000.137960.03410000.00000004.mdmp") Found string "[-WindowStyle