RunPsScript.dll

Description: Run PS Script

Authors: © Microsoft Corporation. All rights reserved.

Version: 10.8804.27858.1000

Architecture: 64-bit

Operating System: Windows NT

SHA256: 20abe0dc926481b849d72a9ff745045f

File Size: 1.3 MB

Uploaded At: Dec. 1, 2025, 8:31 a.m.

Views: 24

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

  • RunPsScript (Ordinal: 1, Address: 0x31660)

Imported DLLs & Functions

ADVAPI32.dll
  • AdjustTokenPrivileges (Address: 0x1800db038)
  • ConvertStringSecurityDescriptorToSecurityDescriptorW (Address: 0x1800db050)
  • ConvertStringSidToSidW (Address: 0x1800db058)
  • CreateProcessAsUserW (Address: 0x1800db000)
  • CreateRestrictedToken (Address: 0x1800db0a8)
  • DuplicateTokenEx (Address: 0x1800db0a0)
  • EqualSid (Address: 0x1800db098)
  • EventRegister (Address: 0x1800db0d0)
  • EventSetInformation (Address: 0x1800db0c0)
  • EventUnregister (Address: 0x1800db0c8)
  • EventWriteTransfer (Address: 0x1800db0b8)
  • FreeSid (Address: 0x1800db090)
  • GetLengthSid (Address: 0x1800db088)
  • GetTokenInformation (Address: 0x1800db080)
  • ImpersonateLoggedOnUser (Address: 0x1800db078)
  • IsValidSid (Address: 0x1800db070)
  • LogonUserW (Address: 0x1800db060)
  • LookupPrivilegeValueW (Address: 0x1800db030)
  • OpenProcessToken (Address: 0x1800db0b0)
  • RegCloseKey (Address: 0x1800db048)
  • RegCreateKeyExW (Address: 0x1800db028)
  • RegDeleteKeyValueW (Address: 0x1800db010)
  • RegGetValueW (Address: 0x1800db008)
  • RegOpenKeyExW (Address: 0x1800db020)
  • RegQueryValueExW (Address: 0x1800db040)
  • RegSetValueExW (Address: 0x1800db018)
  • RevertToSelf (Address: 0x1800db068)
api-ms-win-core-featurestaging-l1-1-0.dll
  • GetFeatureEnabledState (Address: 0x1800db8b8)
  • RecordFeatureError (Address: 0x1800db8a8)
  • RecordFeatureUsage (Address: 0x1800db8b0)
  • SubscribeFeatureStateChangeNotification (Address: 0x1800db8c0)
  • UnsubscribeFeatureStateChangeNotification (Address: 0x1800db8c8)
api-ms-win-core-featurestaging-l1-1-1.dll
  • GetFeatureVariant (Address: 0x1800db8d8)
api-ms-win-core-winrt-l1-1-0.dll
  • RoGetActivationFactory (Address: 0x1800db8e8)
api-ms-win-core-winrt-string-l1-1-0.dll
  • WindowsCreateStringReference (Address: 0x1800db8f8)
  • WindowsDeleteString (Address: 0x1800db900)
  • WindowsGetStringRawBuffer (Address: 0x1800db908)
api-ms-win-core-xstate-l2-1-0.dll
  • GetEnabledXStateFeatures (Address: 0x1800db918)
bcrypt.dll
  • BCryptCloseAlgorithmProvider (Address: 0x1800db928)
  • BCryptCreateHash (Address: 0x1800db958)
  • BCryptDestroyHash (Address: 0x1800db950)
  • BCryptFinishHash (Address: 0x1800db938)
  • BCryptGetProperty (Address: 0x1800db948)
  • BCryptHashData (Address: 0x1800db940)
  • BCryptOpenAlgorithmProvider (Address: 0x1800db930)
CRYPT32.dll
  • CertCloseStore (Address: 0x1800db0e8)
  • CertDuplicateCertificateContext (Address: 0x1800db100)
  • CertFindCertificateInStore (Address: 0x1800db130)
  • CertFindExtension (Address: 0x1800db110)
  • CertFreeCertificateContext (Address: 0x1800db0f0)
  • CertGetCertificateContextProperty (Address: 0x1800db108)
  • CertGetNameStringW (Address: 0x1800db118)
  • CertOpenStore (Address: 0x1800db128)
  • CertVerifyCertificateChainPolicy (Address: 0x1800db120)
  • CryptBinaryToStringA (Address: 0x1800db0e0)
  • CryptDecodeObjectEx (Address: 0x1800db0f8)
IPHLPAPI.DLL
  • FreeMibTable (Address: 0x1800db148)
  • GetIfEntry2 (Address: 0x1800db150)
  • GetUnicastIpAddressEntry (Address: 0x1800db158)
  • GetUnicastIpAddressTable (Address: 0x1800db140)
KERNEL32.dll
  • AcquireSRWLockExclusive (Address: 0x1800db410)
  • AcquireSRWLockShared (Address: 0x1800db418)
  • AssignProcessToJobObject (Address: 0x1800db5e8)
  • CancelIo (Address: 0x1800db588)
  • CloseHandle (Address: 0x1800db2f0)
  • CloseThreadpoolTimer (Address: 0x1800db3f0)
  • CompareFileTime (Address: 0x1800db3f8)
  • CompareStringEx (Address: 0x1800db6a0)
  • CompareStringW (Address: 0x1800db6e0)
  • CreateEventA (Address: 0x1800db2b0)
  • CreateEventExW (Address: 0x1800db558)
  • CreateEventW (Address: 0x1800db550)
  • CreateFileW (Address: 0x1800db390)
  • CreateIoCompletionPort (Address: 0x1800db5c8)
  • CreateJobObjectW (Address: 0x1800db2d0)
  • CreateMutexExW (Address: 0x1800db340)
  • CreatePipe (Address: 0x1800db298)
  • CreateSemaphoreExW (Address: 0x1800db348)
  • CreateThread (Address: 0x1800db198)
  • CreateThreadpoolTimer (Address: 0x1800db3d8)
  • CreateToolhelp32Snapshot (Address: 0x1800db4a0)
  • DebugBreak (Address: 0x1800db2e0)
  • DecodePointer (Address: 0x1800db478)
  • DeleteCriticalSection (Address: 0x1800db3d0)
  • DeleteProcThreadAttributeList (Address: 0x1800db1a8)
  • DeviceIoControl (Address: 0x1800db500)
  • EncodePointer (Address: 0x1800db6b0)
  • EnterCriticalSection (Address: 0x1800db3b8)
  • EnumSystemLocalesW (Address: 0x1800db220)
  • ExitProcess (Address: 0x1800db178)
  • ExitThread (Address: 0x1800db190)
  • FindClose (Address: 0x1800db510)
  • FindFirstFileExW (Address: 0x1800db258)
  • FindFirstVolumeW (Address: 0x1800db4b8)
  • FindNextFileW (Address: 0x1800db518)
  • FindNextVolumeW (Address: 0x1800db4c0)
  • FindVolumeClose (Address: 0x1800db4c8)
  • FlsAlloc (Address: 0x1800db1e0)
  • FlsFree (Address: 0x1800db1f8)
  • FlsGetValue (Address: 0x1800db1e8)
  • FlsSetValue (Address: 0x1800db1f0)
  • FlushFileBuffers (Address: 0x1800db520)
  • FormatMessageW (Address: 0x1800db380)
  • FreeEnvironmentStringsW (Address: 0x1800db278)
  • FreeLibrary (Address: 0x1800db5b0)
  • FreeLibraryAndExitThread (Address: 0x1800db180)
  • GetACP (Address: 0x1800db248)
  • GetCommandLineA (Address: 0x1800db260)
  • GetCommandLineW (Address: 0x1800db268)
  • GetComputerNameExW (Address: 0x1800db570)
  • GetConsoleMode (Address: 0x1800db230)
  • GetConsoleOutputCP (Address: 0x1800db228)
  • GetCPInfo (Address: 0x1800db698)
  • GetCurrentProcess (Address: 0x1800db420)
  • GetCurrentProcessId (Address: 0x1800db350)
  • GetCurrentThreadId (Address: 0x1800db358)
  • GetDriveTypeW (Address: 0x1800db4d0)
  • GetEnvironmentStringsW (Address: 0x1800db270)
  • GetEnvironmentVariableW (Address: 0x1800db468)
  • GetExitCodeProcess (Address: 0x1800db398)
  • GetExitCodeThread (Address: 0x1800db6b8)
  • GetFileSizeEx (Address: 0x1800db528)
  • GetFileType (Address: 0x1800db168)
  • GetLastError (Address: 0x1800db2f8)
  • GetLocaleInfoW (Address: 0x1800db208)
  • GetLogicalDrives (Address: 0x1800db4d8)
  • GetModuleFileNameA (Address: 0x1800db360)
  • GetModuleFileNameW (Address: 0x1800db458)
  • GetModuleHandleExA (Address: 0x1800db658)
  • GetModuleHandleExW (Address: 0x1800db370)
  • GetModuleHandleW (Address: 0x1800db368)
  • GetOEMCP (Address: 0x1800db250)
  • GetOverlappedResultEx (Address: 0x1800db590)
  • GetProcAddress (Address: 0x1800db378)
  • GetProcessHeap (Address: 0x1800db310)
  • GetProductInfo (Address: 0x1800db450)
  • GetQueuedCompletionStatus (Address: 0x1800db5d0)
  • GetStartupInfoW (Address: 0x1800db648)
  • GetStdHandle (Address: 0x1800db170)
  • GetStringTypeW (Address: 0x1800db6e8)
  • GetSystemInfo (Address: 0x1800db2c8)
  • GetSystemTimeAsFileTime (Address: 0x1800db470)
  • GetSystemTimePreciseAsFileTime (Address: 0x1800db5b8)
  • GetTickCount (Address: 0x1800db560)
  • GetUserDefaultLCID (Address: 0x1800db218)
  • GetVersionExW (Address: 0x1800db448)
  • GetVolumeInformationW (Address: 0x1800db4e0)
  • GetVolumeNameForVolumeMountPointW (Address: 0x1800db4f0)
  • GetVolumePathNamesForVolumeNameW (Address: 0x1800db4f8)
  • GetWindowsDirectoryW (Address: 0x1800db568)
  • GlobalAlloc (Address: 0x1800db578)
  • GlobalFree (Address: 0x1800db580)
  • HeapAlloc (Address: 0x1800db308)
  • HeapFree (Address: 0x1800db6d8)
  • HeapReAlloc (Address: 0x1800db480)
  • HeapSize (Address: 0x1800db488)
  • InitializeCriticalSectionAndSpinCount (Address: 0x1800db628)
  • InitializeCriticalSectionEx (Address: 0x1800db3c8)
  • InitializeProcThreadAttributeList (Address: 0x1800db1a0)
  • InitializeSListHead (Address: 0x1800db688)
  • InitOnceBeginInitialize (Address: 0x1800db690)
  • InitOnceComplete (Address: 0x1800db3a0)
  • InterlockedFlushSList (Address: 0x1800db630)
  • InterlockedPushEntrySList (Address: 0x1800db638)
  • IsDebuggerPresent (Address: 0x1800db2d8)
  • IsProcessInJob (Address: 0x1800db5e0)
  • IsProcessorFeaturePresent (Address: 0x1800db650)
  • IsValidCodePage (Address: 0x1800db240)
  • IsValidLocale (Address: 0x1800db210)
  • K32GetPerformanceInfo (Address: 0x1800db1d0)
  • LCMapStringEx (Address: 0x1800db6a8)
  • LCMapStringW (Address: 0x1800db200)
  • LeaveCriticalSection (Address: 0x1800db3c0)
  • LoadLibraryExA (Address: 0x1800db1c8)
  • LoadLibraryExW (Address: 0x1800db600)
  • LocalFree (Address: 0x1800db430)
  • MultiByteToWideChar (Address: 0x1800db508)
  • OpenEventA (Address: 0x1800db2b8)
  • OpenProcess (Address: 0x1800db428)
  • OpenSemaphoreW (Address: 0x1800db338)
  • OutputDebugStringW (Address: 0x1800db2e8)
  • PostQueuedCompletionStatus (Address: 0x1800db5d8)
  • Process32FirstW (Address: 0x1800db4a8)
  • Process32NextW (Address: 0x1800db4b0)
  • QueryDosDeviceW (Address: 0x1800db4e8)
  • QueryFullProcessImageNameW (Address: 0x1800db498)
  • QueryInformationJobObject (Address: 0x1800db5f8)
  • QueryPerformanceCounter (Address: 0x1800db3a8)
  • QueryPerformanceFrequency (Address: 0x1800db3b0)
  • RaiseException (Address: 0x1800db6f8)
  • ReadConsoleW (Address: 0x1800db238)
  • ReadFile (Address: 0x1800db530)
  • RegisterWaitForSingleObject (Address: 0x1800db5a0)
  • ReleaseMutex (Address: 0x1800db320)
  • ReleaseSemaphore (Address: 0x1800db318)
  • ReleaseSRWLockExclusive (Address: 0x1800db400)
  • ReleaseSRWLockShared (Address: 0x1800db408)
  • ResetEvent (Address: 0x1800db1d8)
  • ResumeThread (Address: 0x1800db188)
  • RtlCaptureContext (Address: 0x1800db680)
  • RtlLookupFunctionEntry (Address: 0x1800db678)
  • RtlPcToFileHeader (Address: 0x1800db6f0)
  • RtlUnwind (Address: 0x1800db6d0)
  • RtlUnwindEx (Address: 0x1800db640)
  • RtlVirtualUnwind (Address: 0x1800db670)
  • SetEndOfFile (Address: 0x1800db538)
  • SetEvent (Address: 0x1800db2a0)
  • SetFilePointer (Address: 0x1800db5c0)
  • SetFilePointerEx (Address: 0x1800db540)
  • SetHandleInformation (Address: 0x1800db290)
  • SetInformationJobObject (Address: 0x1800db5f0)
  • SetLastError (Address: 0x1800db300)
  • SetStdHandle (Address: 0x1800db280)
  • SetThreadpoolTimer (Address: 0x1800db3e0)
  • SetUnhandledExceptionFilter (Address: 0x1800db660)
  • Sleep (Address: 0x1800db440)
  • SleepConditionVariableSRW (Address: 0x1800db6c0)
  • TerminateProcess (Address: 0x1800db490)
  • TlsAlloc (Address: 0x1800db620)
  • TlsFree (Address: 0x1800db608)
  • TlsGetValue (Address: 0x1800db618)
  • TlsSetValue (Address: 0x1800db610)
  • TryAcquireSRWLockExclusive (Address: 0x1800db700)
  • UnhandledExceptionFilter (Address: 0x1800db668)
  • UnregisterWaitEx (Address: 0x1800db598)
  • UpdateProcThreadAttribute (Address: 0x1800db1b0)
  • VerifyVersionInfoW (Address: 0x1800db460)
  • VerSetConditionMask (Address: 0x1800db438)
  • VirtualProtect (Address: 0x1800db1b8)
  • VirtualQuery (Address: 0x1800db1c0)
  • WaitForMultipleObjectsEx (Address: 0x1800db2a8)
  • WaitForSingleObject (Address: 0x1800db328)
  • WaitForSingleObjectEx (Address: 0x1800db330)
  • WaitForThreadpoolTimerCallbacks (Address: 0x1800db3e8)
  • WakeAllConditionVariable (Address: 0x1800db6c8)
  • WerRegisterCustomMetadata (Address: 0x1800db2c0)
  • WideCharToMultiByte (Address: 0x1800db388)
  • WriteConsoleW (Address: 0x1800db288)
  • WriteFile (Address: 0x1800db548)
  • WTSGetActiveConsoleSessionId (Address: 0x1800db5a8)
ntdll.dll
  • NtOpenFile (Address: 0x1800db980)
  • NtQuerySystemInformation (Address: 0x1800db968)
  • RtlInitUnicodeString (Address: 0x1800db978)
  • ZwQueryEaFile (Address: 0x1800db970)
ole32.dll
  • CoCreateFreeThreadedMarshaler (Address: 0x1800db998)
  • CoGetApartmentType (Address: 0x1800db990)
  • CoTaskMemFree (Address: 0x1800db9a8)
  • CoWaitForMultipleHandles (Address: 0x1800db9a0)
RPCRT4.dll
  • RpcStringFreeW (Address: 0x1800db720)
  • UuidCreate (Address: 0x1800db718)
  • UuidToStringW (Address: 0x1800db710)
Secur32.dll
  • GetUserNameExW (Address: 0x1800db788)
SETUPAPI.dll
  • SetupDiDestroyDeviceInfoList (Address: 0x1800db748)
  • SetupDiEnumDeviceInfo (Address: 0x1800db740)
  • SetupDiEnumDeviceInterfaces (Address: 0x1800db760)
  • SetupDiGetClassDevsW (Address: 0x1800db758)
  • SetupDiGetDeviceInterfaceDetailW (Address: 0x1800db738)
  • SetupDiGetDevicePropertyW (Address: 0x1800db750)
  • SetupDiGetDeviceRegistryPropertyW (Address: 0x1800db730)
SHELL32.dll
  • CommandLineToArgvW (Address: 0x1800db770)
  • SHGetKnownFolderPath (Address: 0x1800db778)
USER32.dll
  • DispatchMessageW (Address: 0x1800db7b0)
  • LoadCursorW (Address: 0x1800db7a8)
  • MsgWaitForMultipleObjectsEx (Address: 0x1800db7b8)
  • PeekMessageW (Address: 0x1800db798)
  • PostQuitMessage (Address: 0x1800db7a0)
  • SetCursor (Address: 0x1800db7c8)
  • TranslateMessage (Address: 0x1800db7c0)
USERENV.dll
  • CreateEnvironmentBlock (Address: 0x1800db7e0)
  • DestroyEnvironmentBlock (Address: 0x1800db7d8)
VERSION.dll
  • GetFileVersionInfoSizeW (Address: 0x1800db800)
  • GetFileVersionInfoW (Address: 0x1800db7f0)
  • VerQueryValueW (Address: 0x1800db7f8)
WINTRUST.dll
  • CryptCATAdminAcquireContext2 (Address: 0x1800db848)
  • CryptCATAdminCalcHashFromFileHandle2 (Address: 0x1800db818)
  • CryptCATAdminEnumCatalogFromHash (Address: 0x1800db820)
  • CryptCATAdminReleaseContext (Address: 0x1800db810)
  • CryptCATCatalogInfoFromContext (Address: 0x1800db828)
  • WinVerifyTrust (Address: 0x1800db830)
  • WinVerifyTrustEx (Address: 0x1800db858)
  • WTHelperGetProvCertFromChain (Address: 0x1800db840)
  • WTHelperGetProvSignerFromChain (Address: 0x1800db850)
  • WTHelperProvDataFromStateData (Address: 0x1800db838)
WS2_32.dll
  • InetNtopW (Address: 0x1800db868)
WTSAPI32.dll
  • WTSCloseServer (Address: 0x1800db878)
  • WTSEnumerateSessionsExW (Address: 0x1800db898)
  • WTSFreeMemoryExW (Address: 0x1800db890)
  • WTSOpenServerExW (Address: 0x1800db880)
  • WTSQueryUserToken (Address: 0x1800db888)