26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious JS/LausivLoader.B trojan Sample 71d86f769000… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 71d86f769000…. Malware family: JS/LausivLoader.B trojan. Threat score 100/100. 2/26 AV engines flagged this file. 4 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/71d86f769000ceee4fde80551128119ce2a31d0da6bb2ce29f0a725e726c081e","keywords":["Malicious","JS/LausivLoader.B trojan","malware analysis","sandbox report","threat intelligence","71d86f769000ceee4fde80551128119ce2a31d0da6bb2ce29f0a725e726c081e"],"about":{"@type":"SoftwareApplication","name":"71d86f769000ceee4fde80551128119ce2a31d0da6bb2ce29f0a725e726c081e.bin","applicationCategory":["html"],"identifier":"71d86f769000ceee4fde80551128119ce2a31d0da6bb2ce29f0a725e726c081e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"JS/LausivLoader.B trojan","antivirusDetections":{"malicious":2,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b1,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")28:T756,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp")29:T446,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")2a:T7a5,Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "$str = $_ | Microsoft.PowerShell.Utility\Format-List -Property * | Microsoft.PowerShell.Utility\Out-String" (Indicator: "Format-List"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp")2b:Tb48,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007504-00000BC0-612317696") file/memory contains long string with (Indicator: "Aes"; File: "powershell.exe") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.43A28000.00000004.mdmp") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00007504.00000001.108425.294E2000.00000004.mdmp") Found reference to "$musgu = [System.Security.Cryptography.Aes]::Create(); $musgu.Key = $celiotomy; $musgu.IV = $monobloc; $extendibility = $musgu.CreateDecryptor(); $guyliner = $extendibility.TransformFinalBlock($phlebotomist, 0, $phl;" (Indicator: "Aes"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to "LegalKeySizesValue" (Indicator: "KeySizes"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to "KeySizes" (Indicator: "KeySizes"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")2c:Ta0d,"powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-611217186 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-611227230 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-612703492 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-612712443 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-613678457 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-613688136 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-613966402 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-613976417 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-614203308 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-614212363 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-614815019 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-616297803 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-616305696 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-616665369 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-616674088 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-618350071 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-618359551 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-618551644 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-618562007 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-623054751 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-623068701 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-623078428 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-623084770 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-623093746 [PID: 7504] "powershell.exe" queried SystemProcessInformation at 00000000-00007504-00000C15-623102537 [PID: 7504]2d:T822,file/memory contains long string with (Indicator: "CreateDecryptor"; File: "powershell.exe") file/memory contains long string with (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") file/memory contains long string with (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000001.108425.294E2000.00000004.mdmp") Found reference to API "$musgu = [System.Security.Cryptography.Aes]::Create(); $musgu.Key = $celiotomy; $musgu.IV = $monobloc; $extendibility = $musgu.CreateDecryptor(); $guyliner = $extendibility.TransformFinalBlock($phlebotomist, 0, $phl;" (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found reference to API "CreateDecryptor" (Indicator: "CreateDecryptor"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "tripledescryptoserviceprovider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00007504.00000001.108425.D39E0000.00000004.mdmp")2e:Td84,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00007504.00000001.108425.43F69000.00000004.mdmp, 00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp")2f:T6d1,file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000001.108425.294E2000.00000004.mdmp") Found reference to API "Convert]::FromBase64String($env:P1+$env:P2); $i" (Indicator: "FromBase64String"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")30:Ta04,Contains base64 string in header "hall" in header "GET /xZFCj HTTP/1.1User-Agent: Mozilla/5.0Host: shy-hall-9c09.cryptersandtoolsoficial.workers.devConnection: Keep-Alive" Contains base64 string in header "9c09" in header "GET /xZFCj HTTP/1.1User-Agent: Mozilla/5.0Host: shy-hall-9c09.cryptersandtoolsoficial.workers.devConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /xZFCj HTTP/1.1User-Agent: Mozilla/5.0Host: shy-hall-9c09.cryptersandtoolsoficial.workers.devConnection: Keep-Alive" Contains base64 string in header "/img" in header "GET /img_100024.png HTTP/1.1Host: 195.177.94.103Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /img_100024.png HTTP/1.1Host: 195.177.94.103Connection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Keep" in header "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive"31:T558,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains CRYPTO related strings Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match – Encryption algorithm32:T13ce,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acce5cfa7f0000000000000000000051ed195ffa7f000000000000710200000000000000000000f06c379e6a6000002a0000000000000050219943710200008fec195ffa7f0000e0acce5cfa7f0000e0acce5cfa7f0000000000000000000000000000fa7f0000ffffff7f43b3000000000000000000000000000000000000d8cec25cfa7f00002a0000000000000069c37b5cfa7f00003100000000000000e803000000000000ec030000000000001100011000000000c0cf6f79d000000003a3b65dfa7f0000c0cf6f79d000000000000000000000002b00000000000000000000000000000020b0815cfa7f0000b43f805cfa7f0000e0cec25c (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000006829710200000b8e175ffa7f00000000682971020000020000007102000038000000000000004000000000000000300368297102000058e3687ad00000000100000000000000030000000000000001000000000000001600000000000000201037297102000000000000000000000000372971020000689ff9437102000000000000000000007f03000001000000000000000000000080000000000000000400000000000000000000000000000068aff9437102000004000000000000003800000000000000f098b55dfa7f000038000000000000003800000000000000d0e4687ad0000000c00c6431fa7f000000000000 (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b08745fa7f000007000000000000000000000000000000010000000000000020966829710200000000000000000000d0383c29710200004c98b55dfa7f0000304d3c2971020000b3ce5a31fa7f0000e0393c2971020000004f8745fa7f0000d0b08745fa7f000000000000000000000000000000000000e0393c29710200002096682971020000a0da38297102000028e5687ad00000004c98b55dfa7f0000010000000000000028e5687ad0000000a0da382971020000e0393c2971020000010000000000000002bc5a31fa7f0000d03d3c2971020000b091392971020000feffffff040000007df08645fa7f000080d83829 (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000007000000000000000000000000000000010000000000000020966829710200000000000000000000d0383c29710200004c98b55dfa7f0000304e3c2971020000b3ce5a31fa7f0000203f3c2971020000384f8745fa7f0000d0b08745fa7f000000000000000000000000000000000000203f3c29710200002096682971020000a0da38297102000020e5687ad00000004c98b55dfa7f0000010000000000000020e5687ad0000000a0da382971020000203f3c2971020000010000000000000002bc5a31fa7f00000000000000000000b091392971020000d03d3c2904000000feffffffffffffff20966829710200007df08645fa7f000000000000 (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007504) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007504)33:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")34:T691,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007504-00000C17-615110255 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007504-00000C17-615290479 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007504-00000C17-615307743 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007504-00000C17-616169098 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007504-00000C17-616429762 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007504-00000C17-617616525 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007504-00000C17-617759587 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007504-00000C17-61780603235:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")36:T34de,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007504) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00007504)37:Tb448,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007504) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007504)38:Ta248,Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp, 00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00007504.00000001.108425.43F69000.00000004.mdmp, 00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "ConvertStringSidToSid"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSid"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "LoadString"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")39:T5b2,Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp, 00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")3a:T61f,file/memory contains long string with (Indicator: "Invoke-Expression"; File: "powershell.exe") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") Found string "Invoke-Expression" (Indicator: "Invoke-Expression"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") file/memory contains long string with (Indicator: "Invoke-Expression"; Source: "00000000-00007504.00000001.108425.294E2000.00000004.mdmp")3b:T14bd,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007504.00000000.107688.29480000.00000004.mdmp 00000000-00007504.00000001.108425.294E2000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D18705BE-FC2F-44C8-AEF" in Source: 00000000-00007504.00000000.107688.29480000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007504.00000000.107688.43970000.00000004.mdmp 00000000-00007504.00000001.108425.43986000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "HKLM\" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007504.00000001.108425.43F50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007504.00000001.108425.4401F000.00000004.mdmp3c:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3d:T1875,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007504.00000000.107688.29480000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{D18705BE-FC2F-44C8-AEF" in Source: 00000000-00007504.00000000.107688.29480000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00007504.00000000.107688.2B970000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007504.00000000.107688.43970000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007504.00000001.108425.294E2000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "HKLM\" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00007504.00000001.108425.315F8000.00000002.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007504.00000001.108425.43986000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007504.00000001.108425.43F50000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007504.00000001.108425.4401F000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007504.00000001.108425.F69FA000.00000002.mdmp3e:T2049,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa5c0b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa5c0b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa5c0b0000 "powershell.exe" loaded module "KERNEL32" at base 7ffa5ecb0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa490b0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffa5ecb0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffa5ef00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffa49200000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffa5e960000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa5b4f0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffa52b90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffa32e10000 "powershell.exe" loaded module "USER32.DLL" at base 7ffa5ea70000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffa5c0b0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffa492b0000 "powershell.exe" loaded module "NTDLL" at base 7ffa5f150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffa5e4b0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffa5e840000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffa31810000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffa5dbe0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffa5e4b0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffa5dd40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffa30580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffa2fb00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffa35500000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa5a940000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffa5bca0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffa27350000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffa5e4b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffa5e4b0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffa5f150000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffa5e050000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffa5c700000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffa5c4c0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffa4db90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffa52b90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffa5c4c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffa5bee0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffa45860000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLX7LHB5.DLL" at base 7ffa354b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffa35230000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffa350c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffa34f50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffa2f190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffa26aa0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffa5bee0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffa35450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffa26730000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffa5c0b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa34d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffa34d10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffa31730000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffa2f050000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffa34cc0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffa52b80000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffa5b3a0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffa5a590000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa59ae0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffa31570000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffa5ecb0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffa5b3d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffa5ef00000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffa5e4b0000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffa5b000000 "powershell.exe" loaded module "ADVAPI32" at base 7ffa5ef00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffa25a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffa3d220000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffa501d0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffa4ffa0000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffa5dfb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffa5ad30000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffa57a60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffa46840000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffa5aac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffa549d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffa54e60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffa5a880000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffa4b150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffa4c6a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffa257f00003f:Tff4,Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "split-path $_.Path -leaf" (Indicator: "Split-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string ""$(split-path $_.Path -leaf): $($_.Status)"" (Indicator: "Split-Path"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp")40:T84a8,Process "powershell.exe" (UID: 00000000-00007504) was launched with new environment variables: "P1="mT8FnT419RF0n2n6tZNB6cuOHmWKjvWP9LBRwmW/J2r5NGicM53pZvomrjGaOd1PUVPtw+cSdOk9xAnA8T8N6xwpGBrZWkIYC0owzzHvXOdqKo3lojomtvrhA8C/LDPT9xs4bxoeAKZkff7kSEtnxMWGOnRrLEjMSlW/ukluhXdKiPUh31gcu1D317AOElYISzBWnz/I11LPhVDWWy04WWuxG4Yi+LaoMDosJO7H+SBYfQG2IEjt3tpSzObcqrxNbOd3FPx1P5y4ZzYwQ5a8eWdIh+O7MOMl6x1J/XCEeH0OZWefkxLtMfT0qOrcrCc6Hv9kpyPFDlumUPRnZbgOf2zLyYuagEOOOfHSQMVTaUuxYw/QhVCq7n4Wr2r6BqNHZIEDxZsfsveFABCAwiMeT6TyMNVx7AS6CqqLpUX4ZIOxPkgNpNIF5va2gfzVB4SKydwPuimjnA2ZlBuBh7MowGsK0IRgkcuIFWszGZZEBse/ygqqbCO9eSdi/mbQHWfDlsD3k+Zq3y8fWpSeQnoiPZAELX06wns4DENAAjyzrb2s54p7u+WYW4jy4tnEkH0e0i7yisFMm+VdQeLQI6mWlHWuO2l2XeCPbRNPhRvMJ7cLitVqrEfP7BMMdk23b6lxlL7W8ttMOT376QiEG4CwXFDfcH4jCXOuLYVlLGfc/+6XXsCqnM7I1fLTSqa/MF+v3Z5cn48FfFi44grtlnkbzzPV3iullK4yK51MtYFQIma2QmsvzkNH+b5qzWC8JdSYc4yUwhlYN5w07WAsOPy7kUn6COvNfRZa0PhIQb5AZ0POEvXQ+CgiwqoS1tqxck3/xbE/bGUqmI6K17uKrvGlIij4udEVwDduagjx89ZdpH9RK6v1PA/hboSnY5x8h/XQsQK0BoebJNh5IE/1Pkuwd9052uOlq18sJ0e5sociyK3d6wE8ko58gjVLg2Fe/CUvsdC2eaZZhcI/AqFjDERaxPDD+34OIuanLDfOYRiIEXEcyBQVDReKGRA815/jSbvvqukwtgsD6E9Mdc4PT3aQbl5ThoSM6bvzQSl1hDbggjT4WAlg89deOtv8erfXmFhcGST0b3w4dwewLUSmpq12Ur7t4ScZ1ipi6kCTW753dCYwRXqOW5j9xrI8IV+wmw33e2Wk2tkJJzmhTKmktCOBu3dVdBe+Eb76OCsRc0k1WjoGh2MvwPViRwiBOrJShVotUC4s/5Cj2LR6+a3EUxMwnku3nQj9c4GzS1CU8c2Lxepdv3o9kK1mhgGaYnR6Gs1xiMVW86ez8uih8z0Oe5hAERFZNCMynXUlmSoOOmkhKlisoYVAC2V4VUWp8IqskbjM1W+tujRASkmBO9vg+iTyRv4ybJuW13GlKr5HwJVVWpoEeOZIBxaG47oLlC3EInOjXw+jOqlyDjSIjMKYKmQyx3/UsKSlODq6XL0IY8pvxNbdGsDqYdxh+6DJ/9Ahh4xuZCHOeZ2prTKjo43ZxZ5ljuZGIWhGNd+y6svoXsuIQYzRUadoUlKgC8Z0pbL9W4GLLnVgUD86nnyZ2DDVWdo68ksNFTmxlCo+MNT6wydvMbGtGOmZ+9WHYG0UgqRBRcqzCSkOU8qo+wRuzEDjU7LgksuLpJfZGmzYLJWzg9CeTXde5DuKqDXU3U6WLHUXOze+HsGQI1DpMF8MJ0JK75VX296ewV36PSSkbRhTmEdnEj+fqz6mISoE7hA4pO1UErb4Kxd3Z2zMMIQX5b9/JQFkSg4omgD5U6F2/kHWSOofNCf/bGm9AkLpEO9fp1qbpkVJHKIaOKgRTHyuGPVpgeR8SCjSDI+N9gStDv7UthvGiDNVemi35kZSVVm4xnv7dCx9T+A9KA7h3ynvufBc17V9N/44DzfYdm/LHC8GzsyFV+MrrDCJeE86jVfbKtVtERpf1IGvVi6mv/55yvwbZCZTnP/ijBNY2UKZEvqgMNC/d4aqCFAuzfvSY9BNDAG0VrjmAUEaorafqGbJMQZ47WpkAnxAXbculNPvZO0cpIhuqGJzjJ1KaeKXUMrg4hgCzlWpD0Hgjrl8su39xuyyNnZHZ1KeMkagh/skXZtzhckRvJVPYD/vIXzn+dOJi2o5zMkWppSG7vmfBVm7Qfc+rLF6o7PzLEHpYorP+OMn7SmMdF1Ebq/gE7irf5dhhuJ+7pxb0OWqJT0VhQO9/DhX26rdzjwvSWSWyIVyM1p/MRJp9yWu6qOkIW3GGNaCq8hG9pirIXxIaq3In1bkMWTHO79EcALS7D+lUgl2mzbDOKVZSkGaTD6DeB+QDEJ1U72aUB6bDhTBexZ48XhDuUHlAlPO/i/5I3RIzBWA28tS0xw4Qokw2e4tqe2ifN+ZSstnM2JWK+L/2MCQIDsyvR6/Q7LNHeRvYOPMlzGU6N9y346TklIL8vlFMxSKyPidZ/uBqqtQaEF0URcMhbUyabUY8zJn8e0jRAvP/80tjEOtib9iCpgrQArcfS1EDdvXSoXwwct6J1JP1JL7YUWAq7EqlQEYSKgm63GNChI15RIHkuMQXG5GBaC3scBdqPWDAq/GibK7vW8M3wrxLM3r6jKMv5Oqd/p1g/zRyKSlvd40iz2uBkmApieVcgCzhQA5+uOZEEllF/uGDt5+hKFxNLxLk6DdHbCuI0Pt0CeFd/j4WunIgUeZyT2n1sw/auPFWPTe8kACdNffcDku01MZltZVoqQOl64E7YzAay5FSk449HBL3xK6jiLw/o8b6w7kMjH4QbL00zj0dXwv5qdiE9xmQsYlFjOHLwiBD4XTqNwzKaK7A3uvtG/2eFvzKLrdPbt2If4HU37hfk5dzwQe5CtTmW+AsX8+ZEH8Q5fza5zXo/h/TeF11MEv3ZMpjjfzEdJ2CXe/UhhlNhQ3ZVCKNwOyLrPrSqO+vY7UXob/Ju69zChY33/Oo0XkTxWcEahd8FmL7gKDN3Pw8ln0rbW73d8TyaUfndpMeJIjBeUBJNf6EVWa3HTjtgHl19TCdQ4NhUTOxndboX0HIefZKKFRC3zd1gKAE5d++87AbFmqnWXyuIG4J6Hfu6o4K3YS8Ce7WDYiIm5PukuwfmAmfdgE25k4T/2bllgVAyiFIP536kV5JqojVT8bIgVVMNOGOftNvhfCUC8BplIpTxLam0akyMrIlzdHeZZFwjdy4kpLpS78o+qwbER5I0GO7moep17PZUEM6rBUTqyxJCEnBYD5PJNL+uiR7WA/GIcMfykCqg7H8/ZV5PKQxCl40dro6RXzLagtjq2mgHvsWecNtTOI0Ef2iuTMvAqjlWANWgJY4a71I/BdiixyrOOziWin/RmWI5dFZBdhu+YIFdZV64dVIdzoGgwC1rXz+8Oof3MfagPHg9eSqxmd66Loe+VvkmdLjUr4IwKNV9LiNkyT9yjb4xaT7CUgCZFyNgmGmWxYGslGeaMPE2NBY7Pv9YBCKXm1Q3A1qv3oO/7LfG+JLx72J+KKmsNI2ot0835Kk9lvzQyQDJQKE2SO43Trdz2HuDT8J5UDnykaLpo04nLMawVZZI4cjQFBhCNRFqxpARCihRD5RnRdsdoxnV7StIXj9zIaenlXQQBtTPwNg9okRDwmohsW7VB1KPEB9jOKr7DSlulI/NxgnVmDjbs6xdM+v7i6akujhS99Y4ivKy4Vq8hA99gN6xsfM3l5qEx315BuX4yzMBr0u/QEiGPhpV7VVUNa19N3KHMcojNjBQHPpMveUvsqIVEhIhyyuuqJJABQJpN/u6s/TsDGxQd6sWC2JWYiiB9b8g8nWoZYBBekZ83FFymWAH1n1VRCiReWsAhTZR89+ukYeMe8FJ7INtxsZfbMb4A4QWvBt0J6NqSKqvsXlL+63YzfC7YIGt6UoSZ1GY28J7HpqOEbXLklaNDfV3FGb9AoRRAVz3cUtwLGQayKuM97KQcGLMC8cP+UrABj2CnxR7M1QQX88whv+fbGfOBtNFKvyUVHzZxTUB5xaWuObvHkTr/iUqP0gEx1fQUln1U+/Tj0pswuXVO8kckokjeDKMc7d71QIOSu6uvCa6TMBdlmeerjymSVlSsP0RrVofew4VSeJ1EowoI6lAt02OMm8fK0y+b7l/JiN1Vgpu93mSpE7vRNNR7NwZyfmi4Thx1jasjCjV7uGUtyD71plQqi1pW8KRan13fJ+a2Ca59mZFWLn8ldwmo//efwpc45LoP+20x9BecmCbT4T1sn8o2tKtMTPjtnJwvI+s0T6y6R/6x0IrMdTqTMY0QQ8uh9g/7u8Yq36GmrKwJzwgu2QaVtLX5jYzsOV/YgSWfReL4UQaseRZY51KdyHAE7IVVssOtUrhLbWDq3PrtwgzNCTu+8TXQq/VRm0xSOmmf3U7ZzqxCV5JaPwKYIag4uJQczzjwAD3fQfB4rompm/hZVTwYm2mURBLqSDQZjtptvnVEhbl6dUEnfsepUXEC/mdT/+aVYqebo85tC7o/F6xEX7bd84+C5wfhxqjsdJzirciRs4h+onX34Eov83GLiZyLzUisG13nXaScApSkrjEmKr2MPLH1TG/t6yYaeU8lfVGvB/SFctDVWwNt2MqLZvws47NPj7LJnxh7D3BmYny58Q0tO+uHidIToa+bQsO0KU4ZPSPAfme9hSfhn8FQiZiIx8dIkXxLHAmKecjOo6HWvf+4ovY2Znxf+AyFtRfMEjumh5pvLyqtR5VvbkwOJRKg5PXYhHwF+TInoCd/YoQMPie/aggHF+kDXssw7V5FKLGqi3pGKm7KL8nrOchtCoOUe8j1uTMohdO0KxXarv1b5HP0rYlg0bQ1AzziLBjHreAhuS0nZTpCQ1FaElLMQ/jDd1D75aQcRwD2YaZB0aMJhM58a0+ZvLM1XqWgnuq+0xKxQkQzRB3tPgfrsw5MF2iUD2sBZo0AGbOiP84lma6gQSzPeW3y+7r7t6pi1KiZDz7y/kI6c+RuMxERG7/KKBeAggI6OCFYxrMuvOC6v+1y/QZhH0TzLOYTsHHtbLnQZt8M32KEzjZMwEYar+VEtkDTMlmK5a+M48CYLXrpJNOC2wX6rv3NNIv8Fx7J3drSLXUwX+0Xhd9DWBIThsRPD0uNHQnZ/Yy4ME5puiemGbayIW884As33yadE5a5Z2FvAb6aFTLQOv3EKG372WQ2e/Q5IjOV8ouRVOhEMjGKSPtXcR2uqJWOYYZ3RFOWERJFF2elevJkyNKkdjV0NcBry2FlsMr+zOyjmvBJOvJuPlmrHaaDT2YiavBZrnSdJjJ2TKY+EennWtvG8lLt6xudvgKGG7lI/VjGFqk3AuBoGow1kZ5ll+vCrk0mKa0v66ssE+GCR+blsQb0cKBJsb51H2tJGacDByL/AIlzrHXW9XoqQc6kfbx5veiOWkOJatvlUyIyOePrgSQsOZBCUk0pmgj9jwihAZJVNhUiB5q1UkT9npCmR0CiV86Vn0qRDkupRa76UuldqQRG6K2+tIiLCE6g6epBX1ITbHLSox5fn+qJ4hfYvI8SH18Q0J3bEJkK0i+HLLc3Thj6SsalczPZnXnMLbtk5fnqtjO4oDUjS8A7hgmd/oplz6KvphNONyNX7hJC/IX+PBznlEAl2PBVmL7e3XgqN8yIHABmvHXI2d3YHJsBGRmdMvPnhOFyv6ENYZKA9c2z9omA6/KtRQ/XxZw3jaVMOcqJOXX8paj63DZSegKwkDWqMvhjZF+Q4bMpbNEoCpd140DsChAOFLPKA+l1m6khdzz88HS5lU1WKzC5wrOaNYrqcDUbg5vLujhpkZMmj/ZPwUun/GaTojvxuxjfnNRvgoV0VFNKKulCrSoNzMGaCc82UNoxE5D4NGXY3aKDWG/k25JE+GMff63K6V7C0WJnSvsCzXLuQt+mimk2gTy4VfDiMTLhB9rKru3RUvm0UjlSAMs0fCiXJ4vJPaJzOiDd2eV923QK/RC8SXbdFjZZeP0IAgF+bbkV4LY0XvAJkxL95TIDlec/arg4KpklQ3jM5Kj6hXch88Dd4BQ/594nRufqesShRzOCVGjoj83cHjvWx0fReA+TbevoRTHBoOySRRqT1+272YqMkKr7j/rou+CoWQ2IcK3/4pdZLSJdU/nestBiAgeyTC5Olz71uSmlePC+5RoTfu8+bCKO6Kq6wGxd3WRmvOomokx3bKlfRf6g26BLy4Wbw6GSXOlWZURZmxLYxHOBVh1iqQM/+Hr+WeBjpy7AueN3BcNDbXsKKOUA6eO84LHVFUyALJYRDpVV6j+jySANhjrrMX72NZYyJyKBcC4ulIRYIuhWrygIPy598NGpevYURIkbvCTdUhPRthhz/VG7jfhqmd5hlEfrWantE4EH/iwQ8QM401ytgl2qRDhXU4NyqKIdMklvGynmBMv6xzR63MwMRrZ9qPvKJRMMtD7BC6SL2VjMt4p/DHqWujicivthXcbcmdi8NL1I0tx+07lYvptwxJq0YV8//roUDK7OsgvqwkHaNyBfJ4jS+DI5gMlLRnWSDwy99uA1LI1Tv9oVx9FXHOPJ/bxerOMJB3VL/1qsSUp9LgqtQSIFTQeBOl2qmYOo1nOQDAzlEFZ6iLIcFcioh0j66ZXYhtZ/qZiDlhXT4d6icVl8H8HbopxkKC5NlwqYjadKIzN4400cyU/K+4LadWDYdd8Jg17fjYNNNYaR2xdIm1qSuxGTcMJ8x4V42wMTgkHyTwP+TG4nF9/G8oPzGKyFsHNEV+jGFk5tQP3NWuFXwFq4ptqZO2B/K7+irSS/4qUYJu7WFsG0pPMJ/VfNRRXP45GJpuBZA1kjOw7+E/X1pl1wvf5xSK8gWqMTvSs7p7WHaZZ6p+HGn1VrgnjAVl2dMjTn8L0Nq1EARQnKeWtcNoBFkVUibktqwhAlxkwSDjZQK89lKE/HLQLnNSTo3ukpkGo1P+hgn4KkQ1Kj5NxBJxKcmgAadbpidz+jjfTSs2qQnw8a2iBufetffWBGxsM7cut3tZh9tyi9Jw/OIhWyEfFs5oBRnlzIIEEr8tfVf6kkd7AruVtjVsxUK2d+Nm39pFL2e41dPxe7AHX0sWCf3OAExkJt5c7MK1bAFnTsxQieKmLamCAHHYpuRdcCBG/cBvp7efzS1P9oLA3YSbkqbgscnOUqOlk7+8Jo+28A50UgZUMTn49wnmYQFkwKndEAuvNL3ASNdXZUmICUJ+gDRKsyLypAFy8EKkXx2yvLfI29LzXUonpnI222/N6EB03AZ3IMDxMBoAQB6rGfyjK87BIncoagzpBqdItNF1GpQGOJhvuHUWeruZNa1t7k4IGDhx76akzLxzqIqANQF5iiwpFZQL5Cb0xXRfPpQF+a2/U0RnsI0ieZmtqgj8NS3TBWo1Szx5/gq8VpjVEilfpzMv33+2fIfcU9Gh/4sywrfvHi/D38ohmvApVNfDQe7uxJejCqNRYLlVHPcotmpWMAR+qCSAanjkYXAHhoP0PEJfy4+eRGznzXY1qiOPgJYQYBjPYsEM7/VjHhFCBc7MwL1vWU4Q5HORaKsy0jjSJ0HxZZ8UB35Q9Y7/E2CvG6SUIc75kxUl+/VP+a0/ENG4EHFcCmfzfdGeh+qj9q07fOErWB/mvrb+0kFxlW7Y/nh4EE2LXjQHZkIXAgHqB+D8iMcpWCYpnvXKIFocHH1y37nBybLKeFQFL0l1ZSQh86gqkCp2s4H8tEaVcFPS8AFc12/+qLn+1wftIH8kUTS1T1an73YjB4kFJS3HP/6xRJp4kcjWFS7w91GdoJSC2CFHEcHpbQgxZylScx+PBBPyOs3pCprbbCijwLj/9c5iYN/z4b/2lgACDAux9sM0U0sI1bW+NLZ8lesQo9KQbzyFu51rBruMFEnGG9bKNxQ/eWOMB0feP2q6BGTwiZkBpUsU722z1sY/vNd8ISQ1B/WC1j9ekoyL4YbepV0Ng6dphf7uvEzFE5rSnYbTcamTkaDusWn2GRQ6FSvZdSYm3lTG5K+MwszPvBfMbxAiYkUGpu6qeixolastZf1lnODR99dcqzLkaVo9HxQj6X/eFQb4dwjsmdgBtILE620Mwjr3kSAqPMie7RmwSl2cb0RrMEMpUq043bKPY4WFfKzVMhHZL2CKTH2o3Pgt0RvstW0SQ+8oJ3GbY03rIjEQwAkYPsuQh7YuErX6O8xGmV2oTNqf4LnOKQZUDmaygdw/1YVQuYaX8wNBOpQfatHUHANddmJnHrB2IBEzxtgFfUkkxoGoj5rMahx1MHConKhifhiN0bqpsyw7B+WLCpF30K9yw1YwGcq8N3+swSPxrJPsd1FeseNg3snzNgIDertA+mgoTLs+EjrUuzdMKWeok+h3FO3+b2/hyD45AZMqp5IGFjnupUhN94zT/sFXpgT/7pbsMT5iJXKa95UNx5PiUoveA2FetCXrr9ifWAPM3+v84NqNgnp3e+gnB3PJFXTJvcmnW1FuqNHsKsi9EjLjufRPMQy8YKLeao1gbg/o3raj4bDLMMYkbmewjOEI878ar5KPHDLkPIHIepXiNOlLjEp62oeiEUB4Lr/aGT/9HmGzkOCLT4mxfKeaADyGfN6UkOljGXF6iHR7ncFaES+W8LV0tPoDCf4KFUzKBXAMcJV505zxMZgws6TavY3OVlRPoig0bNHDPSNouXwZ6m22uV89mokYeEAKvF/RtAHyo5IYPcR8P8l4y00N47jt/Cl5YSUZ4+x6l7S9ws6WnhtY1/ibF7knYiyX15Zbupa6ZCrqkayaC5t8ZJlB+bhwa0fyF2wzR6EqaBU8sGq5hq15rkF/CpjgdrHdkKRlm1aDItwaKwMWLYvjU/m1Ni7S2H7FXiaAMu3zsoFmrlTcztg8NyyWmfNGivqbzlLNoG1xck5wnamHXvVb1rraH9zMcfQyJs2Gw6RpxJr5hzr1Ls5l2pzeLy9fIqQZaYr+h5pB6nPWwuA5uC7Xj5XrhW0/3DHNBs/GyH1bj5gN8wqz+HPwsIsbIdKrUSYXKAtvR4WP9WrSpA62AomnkflzDNiRxwEBTKWk+DBHOnIBcv7lCrhchyr7G8PlBBjZraU5Lr5CZGsOirRm78RpR5qWV8/fMb94ASIAmljG/yZIJa5Xrvpg7jTfV3IllbfPVBQViHtfHYIbJjkUuoMn7vUtRUbbd74Ct8A7pzW9r7semM7t+ipcO/a5j/hIPv44i7p6nG/nzf9sN8YtLON/DDJ/oHP+dEc5zAdE+Qr0DsWFiRhsSe6wH6Qchxlyy8SCLGNyoQrL2vNQ3XZ0ZnFDhvT4xd808O1GavLuSZHt4+NLAogJGetFK7jsHMkJQuXlyqtHCifiV2ebP4nnEeMPntHt3lhS6St5i2fALr/ngXDdHMtGmRtFU3yF560jdGkY16Nv7jrQvHCdRQ/oDo2NA8UViue2QD1OExOQvgtV3pZ5Yu/xXpqUOOEZ/02dUuyCj4pv+ehjRpTOlT+tAIpJcduMmRKLXrOQRPzx6zMeGd089rOnjyBpjYVHpy82gGbypl0qN+/FofU4kHUbIh2SvHyWxIVAYujFMoBiIq0DNldYdVxGSFhwkfiAY/uHFXOinNvmMa59pebIsgqzj3LQVqNCRBO56sXLp6tcBabKBVIAwaFQ9dHlc3w3HIwgg+dy1U1a3Idwxy0oFHq2dnXndZv5OJyS/BLThxAouaQ7WKZcyyXBlD2IiwxitkQsYwk+22zwc52cNpuYgT8qGHBU8sFy5RYMP9+Mez45IrizgaDxKrQQgP6j5EgEMsklocWKXW4oIxkvh4hM2K6wZRDIV6s1CpRZGneTVG+YjEZDOf1uMbllrHkkU4XuYyCHy4a6RP0M2CNqzADe79geMRvx76SvK3MA9ea1EB6f7KY+TWwYGhImPUohiyvvU5DWqyyClbQN1CzzR/pOn4I5eGRDTVyIBT+rWjDlEpLsiH8PZ/2SDYOyMIyv6jEkqaRcY0oP+7xG+XJnKzKVIbynuJUHhHwjJisV+cXG36eygvjWfZBVKFe/TQotWEwnYnvAK/ngA39iU01ggSQwAMcE4rCMVioOxOSlIue4QtT3JS22E/x0AsSNOQt9AgnJt6IJUgtxLdrmWTf+yu6LYH/8I9gA9eu1bXBsVgQCxzy1Uz0TsDjlsJV6uw7xp3GiKg9TNMF/4OL0pg3pW3hYgaHdjE0W5yohjhEXjnNnegnpbCLxISh++H0wjInWnf8dmSsyu/oyehchclsLMoLHOOxAoRyWbf0xNQAlzKKyOrybzQ/XIUf6Rn/50ieMFEt3LB+jsy9aNrzUR9p1FLF4ZTmxbKRlII050BDQCJpMYe/3q58SpqfsDriQ02wcUzTKoynvLyHkCemBz9vsrAW6tzvjIV0foiAeEUSgqtmhq3sdNu30dY1nh+wvC8K5psUsgAKJTDzpwwpUdYtF7hnMH7S/tQe8lpUQpA4qi8m1VKuX8SJMl6Mi0zJQmaSJuCP2HybFHmLu6z1LXKd7qPWFeOa+aBEou3eCQyBvLshnlz7ZIAZNjTGyHzTa7wBfkDpUtOyDQLIw8Mz4ky5TbIxf4PnXJBkSXeJA6yUDnLZ7jGkY2NKOnGoP0qEcf77iPHw10AgY7uUu5szoNo9dw0h9oMXW8fnRfpQ/VGXI3H59ZKCOrjOQzDjeR35bMw+0QtPi0DOvIknOrN/pGbtfhfutYv5vbQv0qLPIDl436o4yK7cyd9KocOel95g4H4Si6xc4ESjxtYYTik9ceFYbyczYUwmmWG5yOEbu0sHGpfuCv4DUS6jXmZbzoHWoHu2o1F7OEz4J0F38AyjAJIBi4ewuAFOCl/UPEJYeiVk5VVL9+58cd7U9aRPWVbiUK2J0aGsz+DlEuxj/YN/wRyFOvSPEUrSx8I5SUrdzH2eYI/aJVoGV8XAUIE+14nU+/2H/oxscqLrVDAPzt4JFbrYFbvrsxMog1jNy6kHftkyraDxZEWmHuInjil8/0Pw/rwapb+swDBlyT3lfNwY37P8iMPRj9knFjCnTaooihPr9lwuQoriE+DOMC/YJCWZXkT3cjr9OWK5++7yaOc1vRDfMb9+mD6DzKR8loeBmPO0LBJifgoR+JZHQtGvE7nzCj+4oSAsMLk2YWeeXWVXMBhwUoL9ZO8cy5QBCTrVQozG1G3QlOY5r9bqQyY5u72FnJOREPJ/gwbozunkKFjhk1fewfmyJmyg7llfR0+gjVQXNSZq6YrGFqUmmLCjGzm7rhZizpWRRp0XMRALtKuEY8ASFtHDg4yg96bBFfvI/7f10K6drr8QSfJSkJ1DITy+Ti0wiIwE62TPYO9TRhyhRB3RHuRvcOCUjkZOrK+XV3oAVRWSOisJlde0hDLo/iJ49XcfPl1+LIWVAH8fEgHsGf9cVXglMTiVDA5EBQphpVvDl2y0rE7itRuobdD8KpGx6/v6ilUgu1JuwSEtY0viueZI7K0sOHvGtn+JbSMknTTFhSGAoly/+pzHIYFfnSp9k6YMwzf9z7UaKFR4UKegMwjvJ3pnnFLNU3NIcKb6pKj7ouMv0+H+er0UVM75/S7tjcPSVvB0iELA+fP/xu+gO7yVuzPpn+vEmxQ23mlr6sE8nOkgE71epqrUaXnH3G2n5ohOob/4VOEaPHM0s6w71KZbJmNLjGldgfjgRTVbBHkeTiH/HKseab/KqUbLsUYoikN6HWZXzf7yQ4nVIzoU/sK74iwRiLMtdM7TcNXAjOJZ/oMB847qgvH4Q/6ajMxaBy/45ahtwoh3v0tL0uyQM3B7aLHP25Jhfow4/Btvph6QNMRCs9XRfCHITQ5Lta/Yv9h7EyPRjF0Q3hw0L5QGKhtLLVR5Z6GXTCrFkT/e1Q7mRlU/ssnAKWRrVl/ZEVrfYduB0hEsC2dhhTbxEsKxPdiZb24hEVyql2ScFtyPYhAuVSrJjjr/DNaq84NMCz4yeVc/6BOCsz2pIHM2q8coW33yPc4X/Ezi4qHckIpbjPp1WqJ3GkP9tYHglmIh4NvoDB/c70A8UcuoKh5CM6kGi+L99Mn02Jm+3ixLktRuuC+MxcZYSDi3BfRhIyROw751Con8+Lzxj/3tpA8Qr/XT7cZVZXZ7/OEgABNay+TKLdpCyZHE97afISfYiCdI/u5qbTJHkgLralAqs77uXUx61f96rZuFonvtOVpM8c2+rrgbAAFJFTTR6xaUuSPR5X+6PSe40Ti7hIh1ZYd8RJofnr/LnmWGbljjY+kgrCnpsZLmCvriOpM+c5fYCwbOEquUS9hnwFI9Sww0rbKJSndt8y1BZNA+n6vDJsaZ4ZxgIN/SJH45TAIgVczpPhXACtR5O1SBTMM7OIQvFxqqUpQJv648c3KgQvkMybEap7UfOiZ2yzXAjC07WZCm/DkK9zFk1P9LVW1zZWXtXX5Ap5ELUwM1K7jsdc9zZPRGk/kWx9fGBf5Z/vnakjCeA8qUXaC0R6/zDuVCpxMQNeyvI0Ffg1R+kVOewLSegqfSve0Pe5b0D8xfDQsSCKDriZJBzOMiNL77tNDSFpqjsPhYZelG7uBjPLhwQdVn9zCBdjnsIsH1Y5F7q2L5vXIqbEMvtgLDWGuR08UCTXUOiANYiTtRyBTzFXJ4SscWqiCJientG4x11DPw1OJnhXQJMTa7LLB5yb3joyPBrF5OsLWbNkiybclBh/Qq58DemN8OAhuf/e3AF9nDi5N2uk0NXPJTQmi6mYncXsq6VjaOX/jQyMF2/u35yP1P+IhUCFKsaniRJv89/WuSlsjO8RWZoRqFMsT5K0ODlodqP4SBrrAsutDEOnRMhyjBYWV8Qn2V8wJVVMHBeQfkfW0z2VdIEeBwNYVXCOoaBfQyI6ASRqghiFmRIdCZbOJMDwgN37xbu+xEX81qMTsNmu2ygFfq9xpA21WLXh6EgN6dGI8bh87+RE86WKC0baB+xEsyjEsMvo2lIY23DidnYNFCO5YgQhC+i8CjTlE7mo0LBpzfU64Si7dKIccsUjmICCqLxLWIPa+NBahTyJcvt5r/IEnPvPYFd89FQQEhFfXvO+69L7TRORf1ePXwHsVpvB38GFVHYqEPMtH3y/poncIlXsUFwAUWLrQXkpHe1dt53G/GbO0OFr0hcmEw6ATcdYoW+zuVp8nj8LGC4PQa4DMZTM4+TR+IQ6+lxKK8yOIRAdLNggohuF0gLm0T8DQWaSlKcOCfYTHpVkVirJHO23BoEZ+HknGvg696VvFY+nSShYOz+mtHYa1h3uBVNfkmcD+g2LYBDcUevGzW+IImSvcoYyQou/Z6KJUjyfXXcFn5Y6QOadzJSpTfs6aBaZjEm82Xwgr+xexInOdOHr1+U+bxIAE7+qUvcMnvMfEmlEXLzMwtoD7J8wVtdRWnSM7bvq7Azq8KDtCuyO85ohYqnGfPh6tEnRdPW365ShdCxsTITF75KpIkjKKYeOi1cEx+ylU6/7MLN4Q8H9AzrjFLjCZodd7z3QQHto3NT4DE5l9/NwkLmQNoTESPiEbC/+Si9B6lcXwiEiIg8Gk97Znyuw0EN8ui2wArGQL4M6T/2h887jm59SPiGDfXwOJQWYK2+6WTWmwTpUptaHClxeaVFmTWEsK1LtukJYqlB5kbY8hpdbXEWKMlTlLfdNYDCXFebxjKhjmkPwQTooJ8tAY970MStqLH1lHAOi+MPTnsqHNaDoYA9oICvs9Th1m3KLF8L4pRLeo5LIdUcq1T5WbeTJ43MBmmKyl0TgHPP3s3qKyisXBGd8v7RdYMnq3/ZyzqJ+nZsgh+ca81SlWtysAeoZ73ZV2FDJejtpak7g1GjKPjRJZm21RxVVW1JbKnnmohIaKYLsJ4SeDq58iObiw8rSC7FsVKmachVzsQXXJ6HNnkEzJwjExpKn9uTjd52xkS1mtrmYyYT4qBz4E0jBLgEJtosJqfbR6T4X8yMKENFvW4Cc2efpDjTBfaUnkwj3JboqdzHrj3CMIvoCqdgCAQ+1RZjXWLGEWeqLHh2pdyRuEDhR7ISQIesQ+H9NBSZdVQhudWjilnb40OFTv0TOO549xxg0Kpw8MKwSiniCg0uuzGdaAKusOqROZ5QpUnLIqMeDsiorCbYxo8XgGrskbesCuTOHAPmRa0copOPGSE49BNAD2eQy39fuA4PGdG5Kq4GSYezRvIQ70rYIvSIO8Lk+gGefLnv7LjeNYgFLpQSWkgEFPofqB9080UpmN+pzylTEkbpp8w5SlW89op0kMeCw8zA6wfZ94Loo7ejNeuUjiTSY6K/iT5RfafzB9geepsqOqyP96v8DaHgimQyHHGj3x6sWMsaJQfwP+Tfqf5ODz76lYGeV7A5ThQqPuprSPeV9IqmYmz016W9YRhqF/au62y6fYgspFSdYBHL6jsRGAD7h23ehFMrDaRKRHS7SKzaOWMeTW6e0ZKA44TCjzH8agjzefcWt8pi5PadDu8YVOfcrDObiCfaTNjBc9Z9rLAJpFo+Pbp2SlIzcLB54bSzmeqCixlFqfiEJn3hFnZdabGOLokPLzYNt//As8p09gaYMggs9QzjVOBXRASIbWAiXGIhwReqg9nH0ghOI7O9RYS+iqzafy0ldfmCrg6kuYP3YLgV83xyWIhwQg7ErjUSSZGWQgUmLeDyUUFPxxBQSON42wbOo5chTD7PpvDeZGOQjkurNNoZHgxVoM0Bs2kbSvED1Vf+knBllXct8MNd1/mZ1BNtFFw6ZU5KQeERe7l1g5nAsLQRDCZFq+1ehWrUF7iKVh+zr8lNd4U/SdxcRhVWv/CUcn81ol+ugfCXkTxa1Wc6c6jaFWU8SRiX8o91t6nOBY32UJM49SPK6nXzx04LFXjXZeOQZM4R3WBXTKFrRqnDWb8u1GSNlqE2VQzBxiUDSr3RrSwj/qfKf3IL7Mx1UvQWMuCvRs6C0N46uJRnSiURcsqcUS9DRHccJ7sG2zeutSyyRr+nvIElnJHfaoUDT+zY2ibSAnOHNQucr5qxCqTA2nipq2h6p7RvheWFXVmZWjQk1I0Eymm7evI1IALCOyH8xiTAu7rfctcWwiI6++200ETKnMIo87EkwVrZTxkpeqQVQzS46A+zUpNOPH7g1eXy70M9wFb1JG+nbNOJvvOEFexhVghVZsiX7sRNObQ1uBkowHfm98h2dKpURkJVaBKlmcURpdApQDg5vi30cOFkEeJBlO/OuVTq6UTkDOeefuE+RqVcceehp2wqp0wfxJdx81a9+ljpdysu165M6e3PWI1uUA9MkSGcJjsKTRgNr4bjpX7bDnFGDwQIurEeNr6+PRJg968/7Cb1g7vl2BxaVDCfMSpSnYQk7oEjcJAqK+ImTec/hb4i2GXcc/RhIwQmVq1CkwOe8cxOUQKaPa4LB9JcEVqw6LIHRCle11lFEHe8hpiI6/Jc9Ez3MuRbvoDuIijndxd+taWezQY4M+f9kI2iUcrWHJzsdrpswsT9ZsypvkRkhWa8gj0LVZppTX88x8g8m0ToRKKN4Yd3LAYq/xMc9IcO31opO+oX4iKL2blqtu4zrtv/GpyWC92HfVUhtjIx/BeGQSvIJ0j/m520KsZvosHsh7rraqwUUl/pESD8MyGfaAu7iJ9f/FSrteiSF/kHC4F5kzOGO1hSp/7WD1H/Si5r72csnZ7KiWaH47BODz4pnzssSBSFphkpJEMQrye5nCoQtoseMCE0rblIH+Ak5kqzu3G0nB9xoiB+2TIv0pX/z8b8cTNe0nfOOtemSCLofV/4JCGWyS58eWsquCfh3c6xJ5SAtGgP8vdpxehnCCCQbS0avx3Lk4NP8eXeFjc+5P2AaTfk/f+uq5r0vvg1Ro8abR52k0UPR7WDnoPjPq5x1kv8MtDUSzSR0f4MbEkdwCZ6LCawepbGc2jLWNkULHj5Xjwd0RM+tearRQWKLUckz7wzWHNHrfRv8NzhbIDFXLd5PcmFL76+IkiJVMgFJcU5EHd+FLOuYUVC1bXbrTfWBee4NTHov4HP+Xy6114vAx8b3e4D3FYAnUXcGT9vi3lxnsJyVWg2QwYMy2X01Gqj06HI3PVFd5JWK/jlTsS68Iu9sTyKJ/TQQAtZkzAxoSfyMGi0JDgGpMze+GAN4WKtJVe3FQTP8nuF4begc6EWpOdrk3kus47s0cfgE3Ugx0O1aNgwLw5c8sogOeZyPuQy9k4YWk/dsPdg6jLj7FsChPmNqcHk41IFLk0zmKZ5zyqCJE5QIjZFc0rM2aOfPd4bih+h4iOXkE/DNt3Vr6RcbIUq1znI4SXc3ohxhKVxuVvIOlv0vMAtSWe2XCa48/57QIIAq76Cp6FkfAAvBxspN6xdC4RDEJoaXbJNMejoH7/aTgPVD5sQ6oNg+WAs85p2vB7YBm/WUvRuZ2A4JrIr8lSf+rCyMQkMqJRC3LkoXs7F1iSHJKYqBe7/7WDOUXW9TsGlTlh9L/qLR1WKNSQdG6G03w8glSw4vhhrGct/XLVzLBe5xdu1cKbZ9/1Tyvah2HN58lRARiBSL8velDRgUy7tDkT9G3m94DnttLW0ussd/+AfWLS0DI2qxkv6VjAP2TP2kJNMcLIQrvqQkW1YCRG+/utgZhyGkCen08k2299W2txcM8n/XHc1YtduVV4Ykzkj49D+jm8LN4ivcso51HbLaOJzhkEz+8K6ucrIfNvIJoWjpdrurTb4I9gGtO6a4utdegEJJJlC2lzOhMpxEg+mPB1oiQy53R8XXSq5/gp+Ckv3YNWZIp7xk43cpnEmeMrPAu+eRmYmZ7BUrRDna2zdn5e8K6cfCY6We15iMFKuCPocLITyEgj/O2lWFY9FOQRnj2g8SB5erVjg6sPDEmq41yglwbobeWuzPYzkiQrZoa3MpHZU5dEAcm5AhaOl0sHZzoTZI49zyPhyhKt6qA/46aITSOvL38703bqEvtu9nSyI1tEcBPepUIAWoz5OJgIQsE7JuRtvarjBYNaqMy0Ou7GHooo0S3uSk0bdX5y4NaaAUPNLt4BrWRrhTSS0KK3boXCTqTCraLByX1QjdH10VVBQqMdMD7DKAAaoevZziYyH2ke1UDSK2V6uqYAsef3u/rQVAem97CYhaHbKHz0mSdGGqkYpj1Y+3Ak4C65jXN8LQyLYz4yd/Bq1/D/rnLfY00SnTHzzEnXZW2IWV5l09fHNSRZtmN2aWlf/1FtJ6OAtyn4IpZd7adobwzk0wk9AajTqsBiTD3aH6Z4cBJc+r2LHKo/uQ/9bAhucDmMLQz6PsWwboIINML5vJWRNRRh5EjVScOUFKzkuXrA3n2ZWSpFVg2UW7k4rjiUI3q1dsK9xPCUVYZQlYEaVKwc2VMqgAbs2gHuGtVBXUKqOlFrIZ6VGs3ytCF/AqjutSb4LTxvILpXUM1PBT+9xx5wxW1312DussprXbn7T4+dSlJBl5pEYJDqFicCMtDaUeGTac9sEbZYNimId9GbxZuTuWOCO4jQ5NsAjy7fFa3Nvzbo8Vfp+ecOGDxTBhEzRReoZJkaSyC5Fm3wyBEtorRRAhPomdb1uF2iNgBYm3iCYkdMevgbqVThm0NSpzzoDOvWcKna+Z7l+zY4G+GfLW43oGvRa/JyQHlaLd2nW0xKOSLQOA6Gb1ud1LXw63Me3q4fXUKRXkzv+h/SPEfxrw7wwsyQ5weC1BNDGukssHJXwbXzL0xxoN2UJ7ElbLOyW3Yl0WZRWIQ7z5vXkSmu9GXIVz9z9LfON7IAnlHScTpupJErDYXyh7WIt4UT5RfoGl31+DYq+YvMgS/L8Ob1fBf+DRSWoSuV4bvbADFqKBAaLEr+13fDSvwsmhWeK8Ne4sc5gSTbrsMDyW2e7jq1TJSHrNquitJR7ruPzVRoaeYEK5YKR51KI37r1ahN7XGlUj5SowrN8srIIrlmK2AGOEM82B+5crj6i8h6ZSWc3cXendn8LrgKOCzijemA5KW4IYkRyNcc9S10M5toPxqvdJDIhg85g80OnDd2zPvuk+yCEe06oviftsxpK9+oAImxaIL+eNwSJ6qwhjyn4XmIFutV/1D+JN7faHSOzl3bdsuZgcMqwyphSvv3xguTcAUA3fHnGWwRH2CMxWuSipNuB3FVrAk4UuCwTEhm4iET/mTi6UCNOu2zL7C4Tqrj2SQitneduXFqdEX1505YppaxGyzPTDCCUhvtgJUmZwQlGWTlxCtLCwCYL7zeLo0PwTogqR8qWZm6f+6BQKPjjVvv+YzIA68r+kHHWAhVGghp1vNrQYc+ObSRn8EMOl5f0sBQnBbh/Fzxn0BSyLumFJ7RIjzIm7/Ss39mmG+N2jtqv3ItNbx84ao+nWvJm4K8V3+G3PRjxm+/xXkicULxavVXK9GCCwdB1eH3mU4HzpazKDfTcEzkOvDDfyay1ZA6oBZSO+oi8tUcaybToIOID2GBpvVg/Dq/QdeTfT+v4Kc39V/NmWgJ6rhLBExfZ9YqYaWuN01eWxgeWjzC3pzDb36qc8eZTnggB2pezPFc2f4l+5fRQ5/E0H+9QHXNO6O+1noQM1UiFBVIpTaViCtydDXQqMJxt0qj5ymcSjL6BEXjlZbmP5LkJZnP/P1wenbYcFuFlLYbUTA++6G4hhaJGkGIVeXOlKMjl0M5yMcWblxYfLiGqu9P4mszxwdD94VccU1HbWRKBDvlAMMygVsaQsGnqV1G5xUmJtXCBz3jZhrn6csHJ40K1BAByBhDoEsWLWK7ykWOARFQQpiVB4jU7owl1vnWHKJddn1cIMjTamRm8bjf0MVMkQMKKYA0NvHTL+L4yir7x/8mKtu8vYMom5XW3om9KokgzOG6Jxo1momMdX3gHv8UlpHJrgiL92mvLifqxK3Y9xFLrHBVSlxpkYR8FbCfmIVTcfV3iheQQ+dGYHSNwd3k+PFAQmPLf/oqSt8WgMLBXXouhdt1X2GVjFFu8foYHdb5CLn99VPQTKHSbeS5jiA1DuSudg9Omx5dZGbu/TRzMLNSxEZRUp2q50GUGf9ktNDOoc4UQmVhyj7kid9uCvrwmqDVfDZLJf5OZIxSdvp0shx43LkMMirY0Ixym7wca5UcQIl5ANrqRio9pXnPAluVsqV4ThJ0xxcYZWc7mDf5f42Eqi+BBMDHs9TN4k6EWVMNJ7dv7oKLi4NLPy8gtbVrHmWLHz1bqEt11dL9KZ34JHGoVfaeozT8IfEw1Wu0nJ+PUKRF781LPiaVpc5uU1hVUUQxyDODee2BW6i+OVhvmnVN9Q5o0xRYsEE/hoWtcL026Cz1dfsjG8dbAKcDsek3RQMwfkTEw3NjLPEETc78jt8eaQKJPtBt8nPfqQjr5oeaKieFGdXk2XrdXBpxSnnONvtcbL1wOMIach4E2uSm3tOLvIT8sGKuUavQz7/N8M8+3cRvo2fHIQpUaj1BzMqS01DFPECcmcBMVODxO5aE8dl1b6vME/R3pBeXWR5Y1/4z9rQAW5sqbaS2WDobu5ftLdDE/ZUfsdpAbnRrWdZyTVwq0EEureUFZf35g+HOILjcPXrKfBy6xJN4ierHx8FmiE/sx0j4HMzdGsLOD5WYHGYB5YkMFwBmC3Ar5DPIgBF/uij7NQm0Vgp0qTdttK7x8bVwxUcHlVOMcblwpsjzKgHbexdGXxD7w8lAryUAe5moaI6rygp0ZrWfSi1ZT7MqPqXr6WwciyE2ySvbrxy9UpcUaAmvxllO1bb5MsbDlYNKBqvCgmCTOOai2cvw2D/l2HmMrVPIhFYirAvE8R4Ep2J0yIYuOyn340KlLHXSAPrsLNQEeAzpoXbBU5SyjWBUoYcaF67RKGC4npVE+jRvpR7GJz4RGF2DJWGjK8KvJd8YPIsCV5LNAKhOZMGJO3FTp0MrTQsyAiGLmZGUoXLEuX5JMUH6+ZASQqqHPCAPSZH4cd6wOR6n42y0sIEnx55IVRp08uyG0sXjyceyKOP2WLYB+9DhdmlBSqhuaDniIXyijW3corn5F+Y4IknMjJ5Tomco/1ZGGnNUPTXns+l+NjchobPts5gEdDSS0G1qRTrRGGm+kxmDZOE21RDjxzNq/KEYkXkULdhNuZ1xaaMj2hfj1tUnqWpE5m6NV3FTbmcsQh8m0/BcZi9PTJFgRahrP4GcK7rGq4bGoYtS/ICfCelTNMu2e172nJHgBZn16+rTcd/hKdxCerjZ56yH65tN0/GXKVjaEot8fhCPvWblAR3W/BkvVdB0mNCZa1sUf90wOAFD5v3WTaBfzrd6ifTwLWPRCOLpbFLaudprEigdrsLVLw+5j+2tm/2aSzpPjli9blQf05KxjGDfdFd6kS4fcGQuFOLpYTswp/zWDCsMO0jP/I4oc1Wne6keExYp74aVNRkHizviopUq8bQQqsfdeqmTk5mcI2iDO6h4FQhjoGzfZt9XMxN94Tq2rH59GTGDucI2ov0V5HDgv7Ie+++Fpbdl6Y8raJaXIbfkeRWXyW8r8c3boRsPS1za3B1Qq8UjULZb1798gJ++8i7tLVV/XR+Lz8o79xbsbjfUcWFQugWkY/sv/d3IgjEYDUX/KPr9+yX65yCB2q097QjogUzAW9RNSa4/BGzTRSvVz9u2v25cQhcMxqh0tjv1JEscVCuadXXLxcgyvZiFHnp9+NTWiHrVhEFJLtU//oHA4zn0MRlYhLj4Io8P2pqNnooHnvoMBWUT4QRQbss5+SCgRtYJNhnZVO0ruQxZCqwIt8KdQUedQHLfZt3WkmV8TU5+Ak/LstGwGWyhCNHB9Wlkc9n0gRfiW9B11T8J5HF9JjpGoqLD+qsYLjyT6PKya7/NMS3gin3bNk/X6zHywZ+PE76IUM9kndqr4QVI9P6FrvokdtPfO9wB8/PgtxCvDvE+GcFg6+JFjFKNVLsl0/alpK2jhK6CDfrUAVpKqJDemKZ0sljJQ9eQd3uMk6cntOjHCnyfPhRswVeLPA+E7fad00uVJ7VHd28OGMXIXxQznRZ93Q0SoRQmGX20YtXcZz8nyCeBuSiI+WQyrm/Bt+clFQXByXEg/C1pJhPRWtTXK5ZsDPJayxxO/Ot62x6mJA2lAKvti6Z1WNkNTbnu2Lf177KhWierFDWZgmmZXInhhclbBUJH5PQEBF+1Lq53z3upigi+gs5yrQnBs+PiCNDwDd7/z/F2+0dYU71PYbNi+MZimuO7RAq/U3Im4U8+rIM/+8Lmw0gBzLPwEsrA8c9pcPHReHUQZIzsgMjSnH9K8WYVsCmqCSjp6F3lvBGzatyzH1TW+oVIfzmx5XgWuIPPP+dWzGATRJQ/w75EJQrZ9x31CqvgLEGCztvrq6dpMQyfN9f0W/IFGLlW8qjh1kP68d/GcBb2z3PSa0am4Kd9GFaLLhx6elBbqFGCWjnEXWm6Ve0DawU0ElQarUAqHDBtaPHzZFuH5TNXrO2HmxKk4GASX32BhzKu1ZlJ5DjoDXdDRa9XVFytX12zNSxZVMHwZr/0D+v1ltyyrFWb9DE31egCOpyPb2mSQa6QFGkF4cNIJ9tM89Vm0pdzKlOyUAm1zxmLAofNff8hlj0473zl2LmLqkDRhwo/7NLm7rdqgnr2+rYrcA71ZGa1u6gFYl/rGZZqOYeXu+QMi/z0z/qTfdHRtesJKiVqf8wTJYBrexT43PcFnuByUYVWk8bu4mZ+u9zQUKgmDD6jAAB0wbFmIP3qTJ8yOY1Dv6dqs5R/ItL+hRUVPs227jMka8pPLkxaiw2Cb7FSuq5uEGLWUiVjGNXMx8SV5/ULl7bIXea+lMoY3ps+/uwlmF1XVqSqGk4hPtRPZJGzT5eeM92CEEmv4C6As6Led8ZwHFqZolhNlr6/3+NPdwsHCSca4gTwuEBPUZUmvMo+YHXWkouH+MXs5+mD//aY8shsulf29zBSR64VgovYuNDQDlqLU+e04ZYUby4EjBoEqUJS6YHV460gRk6CbpdHStIcQuXvNjMmskUVYW277kzILL0jppwiE6T1xDjbwuXUB7hbMyZEud9QVIUOO25igjodVYbaQQhoAABGIkaezbZjqcVqExJg5F5v9Jjf/aFB/I3YD6g2VXWC/9wRkoj1+mxpIY9u0zURkiPQn2sW8ioBQd3ir90FetPY4hPhHjXWZGr9O4CAG1xwZdeeYrut8+arfZYvJfGzUS48yGPLFNQUaWzCAgR46BSYR0aUysGge4cnhJ1+bC1ZHsgUt7iHGbAS3ltPK7T0y2KqUVieWRw2pLZrw3KTgFQ0H5YRYS6UmUkg+jYIuYDXUiKZaPEvhui7i5UA5EoAYg7l6oH2oa6/hxA8DeW5IFmLc5ZuFmJ6CReMGjL1SK7+RDgi8lBYtYTVjUjszCNNugmmy56tXHrcDMBw9vyTA8SmbvyihpJZBkq2MUHuVDPnaS9tI6vn8AHDyjuytyOs5QsMOJIHcNryqmq8oWK059yhV+ykiYCy2WNVyuEwTrme4PIRIzaHcdZ8SvnjHT9PyJVgG3U/20qx/4ZLKU3N0lFAJrkphFDMt94F3K80ZoQ2B4VE+IRoLk/ezCewUaPsX6dpEUYoJXNNg00BaIUeEC34/3C/quS1kZGWmQ4GriOBm/XW6rWBWJs3nPRBirS02G66mU3A68kCnJtmPiiWeNM/EG4Mw0lmkYvkrINDlIqXPNav0eF4AIDjYpZLU8ZsuWVovTufbeCk7zrQMlq74fQtK5RlVzGu23kkkxV3ti9Vho7fzAUAtiWBm+mWiQ8NzSgmsy/rHr835PATR2QRkPx1ow5lyv/WUB7tCQ1Ok0DGkNfVwt0E4xDiefiwHiHcW8kwVB2WfXCpbE9uMy6OV9sAAebLoudNBKEIX0X/N+ccPkD+8riz6lLK6+vLS6pl/tpn9DCGhEcf4MKBOUQ7UCW9c/265WGqEPmma9v4SPhU27h/r4cGywn2FgOyXb13NyygccEq4akk3JdMCcA3o/P7Os1k8qSf5pu8DALzH9zhJh4fRPF/vObZLzTp00Eo5GalXt6Exu10BVZWphtX9sftol0G8HMABai2LM/N4+KiQz390/0naBtTFmoPM8DxP/B4bidkSmRXkSvv2n9LwBOZx5evcKQ60y4e34MU3eIGn3CDtBZIOLfEYiMFe02OjGQX2LbZ65zYAOC4VyWO1s/t8bfk0w3lk0zTJgaTJODBqf2zY+u+Kw+O4v0f4iJ3ZwW5yqJCztAZMY+mTNGszqNWge8aKEBlnKKRu8uM08LB+qxj2Ad/mzX8ZTokOJwhp9Dr+QcY4KeBOrSXUz99zfc2Eg4wP3DJkmV0OvVCwda5/JxD7+H4lywg3zKsnXDqjbopEAqk5fDrqIghDmesoou290KJY4thvdjk7TsFTmspqPTJJu4LPxtXpoOBDTEAXmvzwB5b+/jjdhtK5jggQ+kKJfU7ASC91yknohnLNpi6a/KQLW1hEV7tqIOw9E/qy0d5gmUMNKSUs48s+sFCv3ktxFQHcKkYHzcsZ8prMz1QFgF0ahop0wRY/336/gohyRl+Vl5jcV3SfwasvYe4DJndnrrP16keC05ONq1PxwgeotDuFP0n8w1X4vHwsCtDV4L7P/PvcQ/GRCoiCRtqkcwNNpXDQjVc40EW7pU0GG/iGVNbtEjCXWovdlwtMSPv8Mkx++RVRPM63S0gBOF1xIC68CHBFqg6BjGndJkRiPTsYKh5p+cJAVGPtVo7sAtO1O5hP2qX7YF+UTBqf0Ia4HjIMvIzne4Xdu8EJ8NCZR8QJ3baH+OKPD1dXDE5NVy4mjsO4bHGAGsib5DETERKassazgQwOGyshn1+4hl+zfq6tkGVFxfaPT6crsg0i5EdfHzGalPZ514hGWAQvTX6HjxvQYUlAnM+5qSvYlPErpmwB1iJ93yhCis9a8kBx6NgK39b7u9MqQsfXwOpOpa0DSTnOJF1yUvGV++RVDm99rKpIKUogo48kVb5t3mebnoLrU3pJ9ElScL7B90Jd1AmRTOSkuNOS4d33FU6gxHWCxzy8MNY3aJ4W3yP3a6LmYfhAYf/OVIzzGLEaLYU9zKdfiVMUg7Lh2099XopLbcy+Y8HZ/PrcRjb6tw/mZcxgvxvw6qC6qndRd+kfkUHEplD/t8I8mI5VANk25vI0hy4DN/3T2hbxtlZM/ZkwaWB6CC1xHJMgJzkQWFj8SWUhDUD+PnZh3QdoqyDWYpz5PrIUnYcJbOjVXqHj8QIEKzVyyl28CY9DwVWHKx2dFTD55G9dNeONusLrOtYwWrCLc7Ez/BrkcV90gwp6lnRdaXBZtmv2PHPrlMx0yZOsXf0OQNjBmIpIOt5HD7W2/mu1K2BCyU5Z0eI7f3JxSuvDSHJ2yvDYAdjUF9MFMPhyo3UrNOlTMbFWvCP/vG9kgUg02cpNh0+dua2Rz3QVuWPv5SwVZa6kKtuELQsyPwZfUSELQS523ZV3u75c3sWKSi3djZkS851fOy+sJ5v18lrHkBpwjHTHnyFd1gBnMQzOa5lPsQRg3ZuWvp8I1jhvYhNH8HymWv9Fxpthp8PKS3OZPoglHdWL2SoSp9s+m5wi3uIkV+E7bhB5ltFSTgdBZKl6QkdKPt+SPn/unVJg7owBWceD3E+DslbD9/oLRjmVyxULJzA+W700q/2x/isPbqJ3IA2XOHv7L5WEWWYTM+JPkGEkubO9tAXjEM20UJeCD3XjC0s1N6vw7AuybQ2k0ozMXMM/WHUVjC1hHe+rj6yGJJ17W/XSo8zVZf8F9t5Ki6/umYyskE0iVOx8A6JKNEtO7IYUSRBOPGCepQqwlEpoFMAXSztHEOij5eVwR70aGHb1OpCNP/VUfXL3o26IQ8fTc2HZKGcSZFjj1PD0C62fy6VbwY+Fp6bL/qJ2HudGcWnEbur/ljvrQvQQ4Gm6wdEhyUVXf6spU8aL/ltZqeCdW3x58OXBPG5b1IMKFPOkbH74PS3vgm5+OzVuf9MzLPrlkz3SbjHqeCYBM02jr0uSGHWHPBFkLSharqEU7GmF2vcd3dem5prWDApj7WkGT0X1WbPM0XTMiodIAx2KwaO8i3IhGUvo4sFJj4v4AyEe9bhRV104PBmgPxhUy9iShTdvsknmI3/pIhF/SvaEtxY8QE+3Va1hPvTC6aavqhnlkn2u7IUIJOuzNo9PsKzfzKcRpTMQi5YgY15x6usKXmOrXbmMeLOElcbTpUYTfc5cnHDUeYziUd0Nck2SYh6k0AifV2XxNplT2QAtebCf4T7nRkYDD0c9eW+vZRyK8pxPhecG+W0UZmAH6NqLGN/ngrg+CmbOtLoa5RIhjazWeVUe65hJpFtuqjSB/thmELm+ww708lM3cwL6EJi/ll/MHHUM0rNRGpJI37324I4R1KAI6kqLueRra9YW6FjNFdIHazorNGZxke2kdc7og0lpRyXtG0vyrBRZVOeNg0D1WN0i8kKkOL2a2YY/mn8l1OdbhDKAZ4yFrxXuOq91Q0sPf1X7s0LGQT3Ii3RWGefSTYPzEmb5bdk/pmTknGW4rFbxhDBo/I9Y5Y/5FgO5//CbCiZIAhjqOmJ5ncloRDexUMwe9DbbLNA0gRo9IHggVnNvzwjDE3GN6cmNqmn7YxghO40FcckRrSfdLVdcdOha82UK25OO8+Alm+8sT+P+Ss7XIWDiJm20IZ5QQdc1n94q9ctUXULrktbnutEQv/ERIMJm6+RqU+SVJz7LWs8PbT03hdpu54Nh/rk4XtaPF1zqwOV6UJEeRutlCFHQlCWAVXGPGzfTawRfiTyFf549v35RQdD04DSqMepsOVKf+bhAjvmCRcA3AK2dAXEl7x++PzGu2W6UuOj3UpQUoPmN0RqZF0ku8aB4qkumrzgpXRR3ZIs5D9F+Gz4IclsSNnZDfPfmDIvVyM25XZ3HSgxuiFpVGvlesALr6fu0cftqySgQwn4+zV8znhSE5uwJbR/q0GQBKHwQV6hM7KT1XW5Nk36/eErEJ3fXWo7mUwrt6ZwKKKvAodtaXtgVtWTe6BTEynBHyshLSZ4oCvwkjn5kLplC8XvxVpSolzD92U77lFVJYxym1/2mmezSwlWUty4jVQfLrHRj4owcV6iiZf9rNyz+2sknCMVlvylpy4bliLgFT7HzB9Q3GtUfNGt0zybzpiVVHMjJS0t7UxYdA/ZnaovIzLOMJg/r1RsDDslAHfwqAYl3YWOoOjGr0MgtFckYtlyLxx3bQNt15RbGfGoeIJ2mpuiD1ltPi3UhdG638clLIECPlevn4hB8V4AEluBqBq8rSjXyjvWxXnwvGOWQvHLq6lT/v0fehUzV45JrXjWkk8rQpxk414f8vUQfg7LRpnPWS6DBhv/qCH+gP9P5Wi7rN3JI0fqtBuXx2HIXKq/svnMFsjspL/Fc/CCfzk3+sjlYNstkGMV6QZITiVQtqdHAxwXIKGPhRL+dcAGerUjRhAA19zaqA4ogip5iSHQvK7F5o83ZBVey90v9HfrDc9LmtUVQD4PYKemSzHnQSvvBsMIUXL8Nluit56Qo0ag+aYjO8Cf/RHswVG4Vwxw3H96hrcxdCfkJnRmelMh+lepEbvy86O+/XQtrrVm79X/wIejxp5RhQdSSfZwp9c1q2qVdcLQBQqPPSfV0tT8hAqgzBCWyJUxSJjnrOaE6ojjRt9LH+cEMFFUswAO2kzkzVHeoWi79xnpCzhp84FMkiX5LBo5mPS3TuOXR+N5VhT6M3lh7Wh5peGK160N694b/y72wMfMk1MLwjmjBv2mEz7WrhVxBaNTuu5RZtTSQAlNbcne+VewV27McZcwoP/6sZW6kTrdjFYe+QC80soGe+JRSKlK3T414NdEj2WPDyV1d181rVGEY4sQ1S4nUxiwKb0hD4zrYD3u20avf33xsFofGFSZwUI3/dPa48RzdU2KNMloLZLWDJYreCnMbWdMckAUXCAvMfCh6oYuHCEKbp6CoWAuUNvCl/DK/8B7dvAah/ZyUXYIAlohIfmFO68mjXXDMWNvDcAJlnoC18TSfqWLXD18vNYWXHTUVANayZ5qEF0253e9HVnaPgm2sq/8iMMVwSdF9GpMYq4KIerp6JXUAUDKtKNPx6ic2rcupYR1Jmi9kVMPZ2r0u14acTJmndx20t/JTH3ZRtWveDo7g8XguRHwuX/K6kDoxe9bl5sy6eGt3QFIjhhxnquqHuAH1/dfps/1i0lp1P5tUp2+NVvsSwirbFgzpFXoVXlQVn+suq1wdG2lALidDW4mUInA8EreqW5N7BypgLbDbqE/XiCNKQ2AoaY7bkmQWvsslPMvgsvXPoNLOGf/uLckQBIomJYeiaXVVK/x9k2qcaxWq4s1TiLQZR9fE978EryII66blXH7uBM6kqgOCJBn6XbnE32JLE46DKIDjmUjVk8+sLyaAjk08SR2+uxoAGLIZhxcQrlKRbYU4FlrQWYpPEUC1THu29OvKKKgOQZEHa5cBh5xr51yi+25sgoEdk5MHqBNCh4o0TDgFrbJy0e/07VfdhGmEeseChlb6OB+9G/WMTGk+Un8Fl0EYmMPpt2MaO5adj5sVTsKxEbIh/Z4/Seb4BXRCQ35T2ir2/R9RXIv/wzhRkYGm+gdBQ9jKaH057g3OLqJlLYOFU6senxhQupZE7N52lrMjJQsqOsq54p2paIPOedHu4A58dMPbGskBkWjCNCkafCmxHkVCbmXfIcKG9LhEFIGgWcyFkBgTGhEA7RPf5UzWYiZKmLs7iV8WaGXjW8ekAquDEBNRytIVaAVY3LWP4kVfDdaE55JdvxWhmoRl2ucfHr+ha9oGS1KDq82zhnLLt6/hQcwZsf4/ry263l0R2BhXZMIhW3cFXB6aaszVCO3a5cNeZH7Lq6aT/O9Yc60jL3d7f+KkvjZfwAyL1lNn5xYHZSzYi4nyXsY1vXf8SNyGx7ZaE6xFb1D/ey9F0o62Ej9otIKr5oJVHI2oB+k3PweyUK4SZP2wOZfIobWEYlxzZVFFcxfmLOpCFkBZK4AfhthKf18UDh2/MumOvai1G77ZKwJS7LDhLAN9mDagsXJWMIYMdMSEoluBkDyIv13JOtp+rOdsmfmfjMQkeCveqXsvrbMUTbuFiCTrGLzeCdc64FdY4V6KtMTXJzVVB+zTja0HDyZYaQlUjHyKQHQmncED6vGSOKWdgfUr4td4hszThyIo6Q0jvHKDayLghEOZTvJkVZBxM0xUosK4TcUdeyB7+pXMuSeUdzo/tsGfm3Su6/xs95NvV+a0L+tZjZO8X73SoDAC3sAxHVs7dDMCbFSO5ry+4lgjYDXKvmUjsBnCBK8UhOALhj9ZnywnyG+l0irRHMxxuSsybxn8pRVyHwP74y40pV0ieEmYJpZUsFKhq5aO5PIytBZat7+adRlFSEYBFh36pTEn/ibhE9Ym7r7aTY9JPEycXfDvCtISS8VBg2M43F46PxwjUOflTyn0H2OaA8fkrKXCjqZOMFUTyni4+jE+DWrVvWxVYOEA9xlzJSXk3VwMqyEBW+186HUswi98AhXGBphn+CDLX1LVTF2mmd0WLZd0guxubLv4ZCnxrWYPx0vEB6IXVRcX5Llu0Tl/JH6YZoykhEOmXt+FBLaGlVyUx4dY4AXr//BW6EuNjqgOm1wvU/peU7dButcy2RGWLbHIn5BCZjckDw/gP1TJjCPn29Cabz4NHXci1eUsEGn8Rdp+D2KF8JKPTNGJb+LBq/4Ozu79o7pU4J3K9wGqC9n5gGakok3EMrPVLgMByiFjsRpCVbPONjGV2B6IZaFZHvnYAe/nKPr3VXgWTJ0oMGY7e73uB3fVfc8qQ8RGLivJdBwkW02AGTqMxYULgRbj0rNLfGROihl+9/qkzAt9gGDB3J7eloJowJEYRUHAESLBANPK3csQnJMjUyWeId++/qbXXE0slBV5wuBlwMD2uXwaD034o8O6Rq875T1we5/A3g5P5iEVv37D+ITZfN5gMirC/O/763Q7lDZqVGU2lw78VQw8c43F6sua6hyq64VnbJeHOt3M2A1jgjXlDJN/MvVQOiK2GR1Yk6qQpjKdW1Qq6MVln/CP1yyfd5xju3zbAHb43hx5raPZHKLN641/cgoQgdc/nTNXKxFPBrmH2fq8CVCu5zMDe4ohZtePLaiDF/9XErxnvgRqjQXAz7exZL2iZS5ulVTIeGx54WEDjKz2UqySAx5d+L1DXPQQcDpfuGH8nkx2aMyuz/eZALsXr0XuqOINNHyejgdos2itStCd/LxlNsZ0EmCbsIHQeBO9z39lUGY5csqUo+k1KpSJyW4fSq6dEXF9ugWZWpE7HDjsGObBY4eDCFXpKbbfZAKz0AYlefAqX/6JN/3YbtI+ICINF7WO6W442h6TuuiEQUJflPZjV0tc8nXoLmXcMLmfI8h3Ec/XyfhFcHqnx+osBsZzM3g/80/O8X2Rr9rNuBASk/3fWCjhNH9YlEGA6BDd6hBcrEj4SobtewznEbXMcjvyzE8wOsNbZLZPucXuhSfnIhn5hkxl9g/pZKT+G+LN97mNzsVdLV9pwA8gmA+ZwLMdesfRAB1nsV52axIXRF6Nsk/NyzutFf4up761hBzN+IYoixdDvBNO8Eotsh5J9vrf3cKVf+D1ygn914IuzkY4lK99Baca7Wf2XIEgOXkQn2UfQW01OKZ+rKzrlOlznw3SxM/5g6VXQlZmlL2Plru9LuNbP4ja7fyHos5ZLJRya4L+mJxZw0aE+9WDJWRqWkoTufggwMya3ZBL7rxAvSXLcrolihyn5gzpZ3QHhiqj7rgSfnlMxqr33gjykrl21eDfGTIO8k6h3EaW+I++W88JfMjZdgOtB3Fv4hz0EJUDzxFOL7p7aXSbaHvLUxpDdvv2wN6GDkXei2Ohl3Xc/B3RQngg8vakoF4T/C2n8MpSHUGlRACM6SxRlAkIcMO8updZUKW4n3RrR/gG/kqHrmlCkae37d/+hoSTqYtfrR0QDGPLDTOZdjgRdneA/ymRMxtToE/L3nAVKUofWoIU/LAF1WATyfvLUQkdZgJN71gH/Xq59YF2QDETiSZEGcCWbwHxdtCVMsJ5iGvY4nKQZDGt2Wdjl/ygSIY1I37s+B4VNZ4GO802Hs/X4buvLLkY/gE", P2="hzJ39aoSuJqEPEOT878dPfkKHZ3UPH9ZoTLgYQFXhDXZYzkmNjS1vAGhiVau4FLPUX6bN9aHRF4oYuYhRth7Vt9hYd00jV+8fOu0q4HP4RMo0BB84m6TkQ3yJwRtmDUkEg9O61EiYBGwl+qSNVuml9aPl05lzFvhwASi1ZWRmw8qpIdrjVgg6wrzQeTc5y5enw7gb+8cXU5/jkH7yprcOGEqnhZYZdJtZ2tvHPyX2DF1hH8tz6We/QB+hgPoKyTGHZgbk+QIg/wdD23nhkklM0nDiqrp1clBnqTtwkasc7Ax4lWpFKFhX/hM3/WzQFjt/b8tclq+uy0bANU13zFnLcv8Jr/a2fhGbYZ4X98TEXPhClfRemATgy40IoY4XbZr3jTH9AcQYuSjXHTrd8UZzsRnMvxKwTPPhtAR7YO5HvlcPjeeppygkTC4q9yVxHQ10U0DkC+kXpVlNDmuTTWEx7IvcX3eudPUrGoJ+HolBC7flcbzsifHPmDSIZnAMV49tFkHs9Sqz/uuGFQy1TW3w5MAG9WMwp7sWx6/rJZi3urXWzjr1O9Bk5gVevRioTr87cq22GZjyYnZ6tV8RcVcVkeJZBgUVFNlsP4KCZt3VK0lkkDwWw7s/03hMoOj7I47PptymQADJfRc1gXC/DT116Ktv8f1fQRHa5YlK9OPZqJhDCxevqNTVUcFj1rFJPA4X6iB0fT1TKqcPccDkjwz/OWM8gCqsgyhd7njDt2VZ0JBK/mpGUswRJ9O4sOpsaimfOPrBAifwMOEZNS50r4gJ1/Tq1qxl706RlQrUH76wKq/V6xNuYy7WvjpB9HdlbI1PxWhXZHUPETgDMh33qGGmimniJYE6EbQgxMX/m9hqy2H9xzOtGrwXv2YTcUQeYTKnnvUaG9ADeZHdsijPS/K52l3J0EdTWKTgVOh/l9ljuFmmENFhK9V6SOtQH7YM1eA1sH5hxnUQOSaqAmTZkiEhRb7AEWmFm+ffu2gRGO3d1czcoUc0pEle1b6SsamDQ1qdpCKCYe3euBFtF80a5+FlLcR6EVtEbWUAxbmW40Qg8aghtmvnVLie2nL52Xkpe/QB6AVqYFBZGjI+Fy19z2w1ajXtVAEVo8rLqhgrkSPP/I8UthH/VnLRjyAfLTVN1CtqjBnEW/3A0Uo6N0xOVUWlIZGUpLfY9G9h0uP8qAmxK7bqNjiF+up74ymgOD5BlPbGYM4yl6WRk/fzP9n88J53X31QAVOR3q+jhCEMOeyHdQxZ2vnhjdBcGFC5WfbglLKLm9G4x6r2FSUGWoOa9yP+mL8yqyM9FvN/Y4LKzZJOmJm2fcY5yboDHayDL6IOWY6VaJbjHUbYkVOTOYzExIm1Z4hT0UGwwSXYEsWNBYwssOeXkTNOh1vFLGh/ZFmRTy02vefq3soCb2Aztcj8iQ24DGjv6tl+UwPUvhmxUpGRuKozfPZE2JEHwzak9JkT/2OhS+nAUFuFPIvvrWDndSzY6Ezt+2d09PnHaRMVlXcuwYR31bJqcTXGnj4D8+iBJtMiJtlERCJYh+qNK7cm7wYEqoJkNwL2NJa1Rl9RBUBh7DfBC1BvirxOB93C1myYjdEPefpmgavF43uiqeruZDjAT1cfksWMl99WVf5rmeOEkl+BgGhNAzhoHzXsBx6REBwKOldEqYHvGxBHx+JkDJ/dCUDp/D7ICvj0nBGF+YsAs58pzcg4U9QNkeHZ2yclibaRnWr/kiQJ8ne7ADrrZpN1aWTCt76tP8E6MsfWQ4oEY3JxZfNxnrEBm1iFIeabMRYY7y7bZRHFyTrJkt7hWLwXH0CWhauv4h84zNzftWfuL6LiNyq8ZixQdIuKYcXOFdlZMDTo33ZwGaLfHi/YLQMgG5+Nf+ERhbQ10eqNczZq6ZTA85qitbzzJGWR5dU0sNu3EInnhr1MEifW5sBoB3Eifjl+UvsJ+rHtwVnhsETpPLBJPqIKfmxpSGQRO4/qfnflC16yfc1LNWpFt1vUSgeBXfaU84/xJue4iDDiBjvsiGYci6i7aiNOPHf7jBC6vIRD/m6kMt5mzzgiiq7BlGauuqAUXxdJoMlrL4TlkHYn++PCaTczs8I77JFX9oRk5BFt3GAbYmsX+2iPH70IbKAQC3TmPFrxGAqb+CCD0SLGwRWffUDjh8126gbLE8YPS9jZvEw7/6NboOPL96/pDEkMb+5uaCH3qgOh6tQsSxJdDbSpO08D4+7ii8E0phwRUYWSQ5a+GxoHBEH5XOOlF7t+ZSBH6cWNqpBOBYn5L05MS+Ycxya8x/oq1vMzFxLCb9JXKjGXxt3r/OAi4RaREm/wyAqClRsoKargKRsRdoCBcBjN6vR8j9yfYcNYvtETsK9M4DAOZ5IOZG+dlyOFzXmTd3QYbvK2PwqKWIp483k3vGU3PsxsY/pVQGcXjLt4lTqYxXdwL6Ujspnaxl09kM/Xv0qkECKvwW1eOH4il2wPpg2qEQ2jHYtGU4eXC8NZDx7PXWK6rwvM+I+3AYGfDUu1IhXIIzgTBWpcpAa8Zs3b6WHlKtKlHm0erjATXBK7vzQxMeC0iAGAm3o3X5jJe7li8pvSesNDTSPQFq5/l+5Gy/MdPETfdXsW24zUxc+ErOqVN+pw/+Yz4WjCmrhJBWe1XAyh7f8F+ARSgT1zMrk0D7rEVs0Sl+ScomynC1aC3nRDpswfq3olNjwqGR1TpowetnxyRXZ6MR8JEIsHRURcqHfrVBI4j33c+iBjKLCV/JBrR6dPu42LOp/Oc7TgPkNhZYvY8Bl+v7FcF8bT/6Ij7H2uDdMiJjY/WPka0gh51hSfbRt/P+4WuwDGZhG2M81/KwsHizEOLVYkDo6xhput0GFTJWIOjpYavFb2vi9Y8ZDJ9AIcu0Xq0DGains3PY0RCmwbAOFNHLt71Uc4hmSUO/I62GVW3s05CzP1ONVM2Bw2FP56qDikc94HJyDrKMvp+L0RNw9HYWtdgVJVIWOzD/EvLmHdtRHzKNtSpXOdXRd9s9JIKxulRq2kIZOoRhruMANQ/5HHzLNWyesnGMRrhS+uAjvIaJgAM566MDx2S0Q4BSYCJPeTUoZwbZdYFGYliko5G25ssuPG+oveetQWn+UBRiQI7OqD+g9Xx/TaHO7O9NP9jmxrT49JJQcBWyf9xPw6s2eB3m9vIhIs0r9rLXIWcJeK92fwrk+ARX245MYQUSDoUL2yRXzixo2tN6yjvMvz1x74dps8QwQ8+Co/8n3OVqudj6x1ZSggZM="" Process "powershell.exe" (UID: 00000000-00007504) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles" Process "powershell.exe" (UID: 00000000-00007504) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432" Process "Caspol.exe" (UID: 00000000-00004248) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "Caspol.exe" (UID: 00000000-00004248) was launched with modified environment variables: "PSModulePath, PATHEXT, NUMBER_OF_PROCESSORS"41:Tfcf,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007504-00000C2A-611566842] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007504-00000C2A-611892812] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007504-00000C2A-612012322] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007504-00000C2A-612100479] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007504-00000C2A-612277835] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007504-00000C2A-612342881] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007504-00000C2A-612405586] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007504-00000C2A-612475936] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007504-00000C2A-612558585] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007504-00000C2A-612605582] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007504-00000C2A-612675162] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007504-00000C2A-612920278] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007504-00000C2A-613020814] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007504-00000C2A-613381042] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007504-00000C2A-613396570] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007504-00000C2A-613754186] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007504-00000C2A-613865645] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007504-00000C2A-613936883] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007504-00000C2A-614003050] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007504-00000C2A-614019424] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007504-00000C2A-614160360] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007504-00000C2A-614392277] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007504-00000C2A-614632875] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00007504-00000C2A-615090786] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll" [Source: 00000000-00007504-00000C2A-615132056]42:T85a,Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp")43:T559,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POWERSHELL\3\POWERSHELLENGINE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SYSTEM.CONFIGURATION__B03F5F7F11D50A3A"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WSMAN"; Key: ""; Value: "")44:T835,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")45:Tabc,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll"46:Tb87,"powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_HOME%" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML"47:T43d,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007504-00000C2B-618242578") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found reference to API "'The name of the computer to connect to." (Indicator: " connect "; Source: "00000000-00007504.00000001.108425.44250000.00000004.mdmp")48:T544,"195.177.94.103" Potential IP "64.124.12.162" found in string "/xml/64.124.12.162" Potential IP "64.124.12.162" found in string "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive" "2.5.29.37" "2.5.29.35" Potential IP "195.177.94.103" found in string "http://195.177.94.103/img_100024" "2.8.20.0" "192.168.0.2" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" "1.1.0.1" "3.0.0.0" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Data,4.0.0.0,,b77a5c561934e089" "2.5.29.31" "2.5.29.15" Potential IP "2.5.29.35" found in string "#2.5.29.35" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.32" "2.5.4.5" "2.5.29.14" "2.5.29.17" "2.5.4.3" "2.5.29.1" "2.5.29.10" "2.5.4.11" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.10" "2.5.29.16" "192.168.0.1" "255.255.255.255" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken" Potential IP "10.0.0.0" found in string "icrosoft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a" "15.0.0.0"49:T205d,Heuristic match: "checkip.dyndns.org" Heuristic match: "get / http/1.1user-agent: mozilla/4.0 (compatible; msie 6.0; windows nt 5.2; .net clr1.0.3705;)host: checkip.dyndns.org" Heuristic match: "reallyfreegeoip.org" Pattern match: "http://195.177.94.103/img_100024" Pattern match: "http://www.microsoft.com/windows" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft.powershell.se" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Heuristic match: "ystem.co" Heuristic match: "ol.cg" Heuristic match: "t type=system.web.co" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$_.subjectname.name" Heuristic match: "$_.issuername.name" Pattern match: "go.microsoft.com/fwlink/?linkid=113216" Pattern match: "go.microsoft.com/fwlink/?linkid=222527" Heuristic match: "2.0.microsoft.office.in" Heuristic match: "ntrust.net" Heuristic match: ".automation.re" Heuristic match: "ystem.management.automation.re" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root.cr" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://se" Heuristic match: "ows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "l9.cr" Pattern match: "crl.microsoft.com/pki/crl/produc" Pattern match: "http://www.microsoftu" Pattern match: "http://www.microu" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "oft.com/pki/crl/products/" Pattern match: "crl.microsoft.com/pki/crl/products/microo"4a:T55d7,Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris>commonprogramw6432=c:\program" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007504.00000000.107688.43970000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007504.00000000.107688.45872000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportdata:\programdata\microsoft\windows" - Source: "00000000-00007504.00000001.108425.29380000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007504.00000001.108425.29380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007504.00000001.108425.29380000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007504.00000001.108425.29380000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00007504.00000001.108425.29492000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00007504.00000001.108425.29492000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00007504.00000001.108425.315F8000.00000002.mdmp") Found URL "https://seows-client-features-package00112" - Source: "00000000-00007504.00000001.108425.43970000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;tt3;" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris>commonprogramw6432=c:\program" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysgeotrust" - Source: "00000000-00007504.00000001.108425.43986000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007504.00000001.108425.43A28000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007504.00000001.108425.43A28000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007504.00000001.108425.43A28000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/producwashington1redmond1microsoft" - Source: "00000000-00007504.00000001.108425.43F69000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0rosoqs[\rosobsjbv4.0.30319" - Source: "00000000-00007504.00000001.108425.43F69000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0http://www.microsoftumicr" - Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microu1+0)" - Source: "00000000-00007504.00000001.108425.43F92000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microo@qdu010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007504.00000001.108425.4401F000.00000004.mdmp")4b:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp")4c:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007504) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007504) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007504) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007504) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007504) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007504) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007504) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00007504)4d:T2ff5,file/memory contains long string with (Indicator: "aes"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "createdecryptor"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "powershell.exe") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "createdecryptor"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "System.Security.Cryptography"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.2B970000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp, 00000000-00007504.00000001.108425.29600000.00000004.mdmp, 00000000-00007504.00000001.108425.43986000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00007504.00000000.107688.29380000.00000004.mdmp, 00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000000.107688.43970000.00000004.mdmp, 00000000-00007504.00000001.108425.29380000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp, 00000000-00007504.00000001.108425.43F92000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "createdecryptor"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "System.Security.Cryptography"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.29492000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "createdecryptor"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "System.Security.Cryptography"; Source: "00000000-00007504.00000000.107688.29480000.00000004.mdmp, 00000000-00007504.00000001.108425.294E2000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00007504.00000000.107688.29680000.00000004.mdmp, 00000000-00007504.00000001.108425.29680000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00007504.00000000.107688.2B970000.00000004.mdmp") Found string "[-WindowStyle