26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7de5f5f6f3b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7de5f5f6f3b1…. Malware family: Trojan.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023"],"about":{"@type":"SoftwareApplication","name":"F451E0FF325AAFFB349600854C2D9184.exe","applicationCategory":["peexe","executable"],"identifier":"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1267,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000000.147779.03181000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.03181000.00000004.mdmp, 00000000-00000752.00000001.148312.07726000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp") Found string "2,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35",0" (Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000000.147779.05130000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp, 00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "[System.Management.Automation.Language.IScriptPosition] $positionOfCursor," (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput(" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=MSIL" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\System.Management.Automation.dll" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "System.Management.Automation.dll-Help.xml" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "System.Management.Automation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "$errorRecord = [System.Management.Automation.ErrorRecord]::new($_.Exception,"NewTemporar" (Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp"), Found string "ge -Category ([System.Management.Automation.ErrorCategory]::Pars" (Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found string "$errorCategory = [System.Management.Automation.ErrorCategory]::InvalidData" (Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp, 00000000-00000752.00000001.148312.07660000.00000004.mdmp")28:T64c,Found reference string ""powershell.exe" -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Documents'"" (Indicator: "add-mppreference"; Source: "00000000-00001536-00000C47-7053683012") Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'" (Indicator: "add-mppreference"; File: "AMSI") Found reference string "-Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Documents'"" (Indicator: "add-mppreference"; File: "powershell.exe") Found reference string "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'" (Indicator: "add-mppreference"; Source: "00000000-00000752.00000000.147779.00D30000.00000004.mdmp, 00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000000.147779.03181000.00000004.mdmp, 00000000-00000752.00000000.147779.04AB0000.00000004.mdmp, 00000000-00000752.00000000.147779.05130000.00000004.mdmp, 00000000-00000752.00000001.148312.00D30000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.03181000.00000004.mdmp") Found reference string ""powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'"" (Indicator: "add-mppreference"; Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp") Found reference string "HostApplication=powershell.exe -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents'" (Indicator: "add-mppreference"; Source: "00000000-00000752.00000001.148312.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.08C90000.00000004.mdmp")29:Ta85,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp")2a:T8af,file/memory contains long string with (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "elWrapper.EndProcessing() } } catch { throw } } # .EXTERNALHELP MSFT_MpWDOScan.cdxml-Help.xml}Microsoft.PowerShell.Core\Export-ModuleMember -Function 'Start-MpWDOScan' -Alias '*'" (Indicator: "Export-ModuleMember"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "# Format-Hex cmdlet helps in displaying the Hexadecimal equivalent of the input data." (Indicator: "Format-Hex"; Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found string "function Format-Hex" (Indicator: "Format-Hex"; Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp, 00000000-00000752.00000001.148312.07660000.00000004.mdmp")2b:Tb72,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER32") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCHANDLER32") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER32") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER32") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\LOCALSERVER") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\ELEVATION") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\ELEVATION") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM")2c:Tdeb,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" queried SystemProcessInformation at 00000000-00001084-00000C15-1273881264 [PID: 1084] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" queried SystemProcessInformation at 00000000-00001084-00000C15-1273890686 [PID: 1084] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" queried SystemProcessInformation at 00000000-00001084-00000C15-1274107690 [PID: 1084] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" queried SystemProcessInformation at 00000000-00001084-00000C15-1274126040 [PID: 1084] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" queried SystemProcessInformation at 00000000-00001084-00000C15-1274319593 [PID: 1084] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" queried SystemProcessInformation at 00000000-00001084-00000C15-1274328664 [PID: 1084] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1275510149 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1275519465 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1275787685 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1275798208 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1275899285 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1275914336 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1276366178 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1276374852 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1277212154 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1277221548 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1277917796 [PID: 1536] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" queried SystemProcessInformation at 00000000-00001536-00000C15-1277926456 [PID: 1536] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1278654542 [PID: 752] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1278663647 [PID: 752] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1280124014 [PID: 752] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1280131997 [PID: 752] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1281378694 [PID: 752] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1281387097 [PID: 752] "powershell.exe" queried SystemProcessInformation at 00000000-00000752-00000C15-1281630184 [PID: 752]2d:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}2e:T477,Assembly shows XOR instruction xor byte ptr [ebp+0Bh] bl in Stream UID: 50179-4536-00410FBC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001084-52012-352-01120DF8 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00001084-52012-2129-010B40A8 Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00001084-52012-2774-010B4544 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001084-52012-3437-01121F40 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003076-64236-190-004823F0 Assembly shows XOR instruction xor eax dword ptr [004A5480h+esi*4] in Stream UID: 00000000-00003076-64236-190-004823F0 Assembly shows XOR instruction xor ecx dword ptr [ebp+edx*4+00h] in Stream UID: 00000000-00003076-64236-287-004746C0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003076-64236-287-004746C0 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003076-64236-1015-00405C3F Assembly shows XOR instruction xor eax dword ptr [ecx+edx*4] in Stream UID: 00000000-00003076-64236-3625-004745902f:Tc051,Found XOR loop in file "man.exe" at offset 449884; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 506295; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 539688; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 623073; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 678734; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 739315; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 785542; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 917624; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 945863; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 1111251; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 1124885; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 1159863; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 1343027; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 1357835; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 1360319; code bytes = 30d0 Found XOR loop in file "man.exe" at offset 40934; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 40953; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 40972; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 40991; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 41010; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 41029; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 41048; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 41070; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 41110; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 46844; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 46884; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 47382; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 53833; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 146857; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 152914; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 412266; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 488265; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 512933; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 580907; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 631245; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 698503; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 703664; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 762055; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 812271; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 849309; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 887680; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 924305; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1012818; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1070234; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1121648; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1271031; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1277012; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1281426; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 1349091; code bytes = 33c1 Found XOR loop in file "man.exe" at offset 421768; code bytes = 8030 Found XOR loop in file "man.exe" at offset 502074; code bytes = 8030 Found XOR loop in file "man.exe" at offset 520302; code bytes = 8030 Found XOR loop in file "man.exe" at offset 669399; code bytes = 8030 Found XOR loop in file "man.exe" at offset 724541; code bytes = 8030 Found XOR loop in file "man.exe" at offset 742954; code bytes = 8030 Found XOR loop in file "man.exe" at offset 769304; code bytes = 8030 Found XOR loop in file "man.exe" at offset 770593; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1064662; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1100639; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1257295; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1343008; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1345788; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1354558; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1358608; code bytes = 8030 Found XOR loop in file "man.exe" at offset 1359908; code bytes = 8030 Found XOR loop in file "kail.exe" at offset 456547; code bytes = 30d0 Found XOR loop in file "kail.exe" at offset 456627; code bytes = 30d0 Found XOR loop in file "kail.exe" at offset 456803; code bytes = 30d0 Found XOR loop in file "kail.exe" at offset 299270; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 383190; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 383196; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 396893; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 454325; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 464868; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 464903; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 464938; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 464973; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 472853; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 474036; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 507340; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 540417; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 540819; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 540854; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 540889; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 540924; code bytes = 33c1 Found XOR loop in file "kail.exe" at offset 71210; code bytes = 8030 Found XOR loop in file "kail.exe" at offset 94366; code bytes = 8030 Found XOR loop in file "kail.exe" at offset 655740; code bytes = 8030 Found XOR loop in file "kail.exe" at offset 658542; code bytes = 8030 Found XOR loop in file "kail.exe" at offset 663820; code bytes = 8030 Found XOR loop in file "kail.exe" at offset 667553; code bytes = 8030 Found XOR loop in file "NVIDIA.exe" at offset 133692; code bytes = 30d0 Found XOR loop in file "NVIDIA.exe" at offset 43314; code bytes = 33c1 Found XOR loop in file "NVIDIA.exe" at offset 95236; code bytes = 33c1 Found XOR loop in file "NVIDIA.exe" at offset 109027; code bytes = 33c1 Found XOR loop in file "NVIDIA.exe" at offset 14979; code bytes = 8030 Found XOR loop in file "NVIDIA.exe" at offset 75233; code bytes = 8030 Found XOR loop in file "NVIDIA.exe" at offset 154096; code bytes = 8030 Found XOR loop in file "NVIDIA.exe" at offset 159003; code bytes = 8030 Found XOR loop in file "NVIDIA.exe" at offset 168992; code bytes = 8030 Found XOR loop in file "NVIDIA.exe" at offset 173899; code bytes = 8030 Found XOR loop in file "bypass.exe" at offset 52943; code bytes = 8030 Found XOR loop in file "bypass.exe" at offset 62960; code bytes = 8030 Found XOR loop in file "bypass.exe" at offset 67867; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 50714; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 706124; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 966540; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1949608; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3006521; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3008033; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3012839; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3014565; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3017163; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3027487; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3029199; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3029783; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3041295; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3042799; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3043637; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3044207; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3046405; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3050049; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3051103; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3058975; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3064707; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3072411; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3076155; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3078821; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3084395; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3106413; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3113747; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3117507; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3118345; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3120385; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3124365; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3126635; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3127065; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3127793; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3129363; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3133399; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3140277; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3143525; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3153723; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3163065; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3170427; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3176043; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3178243; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3184347; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3185395; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3188377; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3194471; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3197925; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3202069; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3204009; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3216045; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3226941; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3227545; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3229217; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3231737; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3233361; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3238483; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3243671; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3245719; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3247775; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3249791; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3251797; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3253827; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3255847; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3257727; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3261251; code bytes = 30d0 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 192566; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1028138; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1028241; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566019; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566052; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566085; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566118; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566281; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566523; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3037745; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3045831; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3063175; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3064819; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3073945; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3076245; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3082819; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3089121; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3091017; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3102607; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3117589; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3141465; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3141957; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3145949; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3164163; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3178029; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3192887; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3199661; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3219981; code bytes = 33c1 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 160760; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 160787; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161197; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161224; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161463; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161487; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161712; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161793; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161816; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161840; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161868; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 161892; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 538026; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 942200; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 942367; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1174721; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1184656; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1205951; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1208870; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1218985; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1378801; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 1667791; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2006316; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2022049; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2055699; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2134788; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2162616; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2170390; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2171004; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2171020; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2171053; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2171067; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2172823; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2172839; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2172872; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2172886; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2183273; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2219935; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2566354; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2850942; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2852359; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 2873388; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3005970; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3023390; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3027448; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3031954; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3039610; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3048206; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3054446; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3055574; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3057236; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3057858; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3072616; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3077764; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3085814; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3087454; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3091966; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3099398; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3104068; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3105778; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3113708; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3115316; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3117498; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3118326; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3122274; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3123296; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3126596; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3127754; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3128440; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3129324; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3135900; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3140762; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3146748; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3151632; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3153684; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3160210; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3162816; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3165820; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3175406; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3176020; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3177528; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3178204; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3181590; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3184308; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3185356; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3187534; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3188370; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3196280; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3206382; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3217246; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3219908; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3231132; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3233322; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3243632; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3245680; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3247736; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3249752; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3251760; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3253788; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3255808; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3257688; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3260064; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3261212; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3265595; code bytes = 8030 Found XOR loop in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" at offset 3521483; code bytes = 8030 Found XOR loop in file "is-HINRB.tmp" at offset 456547; code bytes = 30d0 Found XOR loop in file "is-HINRB.tmp" at offset 456627; code bytes = 30d0 Found XOR loop in file "is-HINRB.tmp" at offset 456803; code bytes = 30d0 Found XOR loop in file "is-HINRB.tmp" at offset 299270; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 383190; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 383196; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 396893; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 454325; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 464868; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 464903; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 464938; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 464973; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 472853; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 474036; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 507340; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 540417; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 540819; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 540854; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 540889; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 540924; code bytes = 33c1 Found XOR loop in file "is-HINRB.tmp" at offset 71210; code bytes = 8030 Found XOR loop in file "is-HINRB.tmp" at offset 94366; code bytes = 8030 Found XOR loop in file "is-HINRB.tmp" at offset 655740; code bytes = 8030 Found XOR loop in file "is-HINRB.tmp" at offset 658542; code bytes = 8030 Found XOR loop in file "is-HINRB.tmp" at offset 663820; code bytes = 8030 Found XOR loop in file "is-HINRB.tmp" at offset 667553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 639916; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 640044; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 693652; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 699220; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 706111; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 707607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 708661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 709941; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 717253; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 722683; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 725671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 726783; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 733875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 742919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 750137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 750731; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 751837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 752919; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 759063; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 761297; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 766739; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 768789; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 770819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 773735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1030684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1060450; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1102317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1181947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1226281; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1290093; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1297421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1376887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1495355; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1502633; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1574894; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1603001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1613005; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1695613; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1898885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1959232; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1974611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2068511; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2101636; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2324010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2333357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2410849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2439344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2582880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2849329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2890094; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2926472; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3221929; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3222632; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 150138; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 737405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 744041; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 759761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 760809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 989392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1015592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1040669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1101207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1136390; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1212241; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1323791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1333393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1531597; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1557431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1628959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1664664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744386; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1972640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1984398; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2040521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2042125; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2200857; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2205266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2239111; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2240293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2291107; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2595693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2599306; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2730727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2732083; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2886596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2896762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2898429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2914821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2926731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2943768; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2973849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3118042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3285760; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3323988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3328064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3372724; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 125812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 125839; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126276; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126539; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 126944; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 155064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 451064; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 705554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 711642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 712476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 716544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 721388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 723618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 732248; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 735020; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 740354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 747266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 749552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 750136; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 753492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 755026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 761688; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 763240; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 766700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 768754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 770780; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 771866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 773696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 774923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 929927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 966533; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 979572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1026950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1197741; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1221549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1249729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1270277; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1555118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1569453; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1655824; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1660280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1661450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1785159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1811023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1921523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1923366; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2088481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2116562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2132849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2162718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2221642; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2310195; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2328365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2348841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2393058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2436413; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2454354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2457147; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2461532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2542753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2685577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2712877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2770544; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2785848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2870536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2872470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2881321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2882133; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2907358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2971101; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2983297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3076007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3137676; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3149433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3252199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3257226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3258994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3314673; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3460190; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3469480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3472217; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3472464; code bytes = 803030:T515,Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp")31:T4e1,Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000752-00000C2C-1281230859") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00000752-00000C2C-1281230884") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe")32:T2818,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000f7d33d95fffffe7f88f58f000800000094fc8f00a018237373d696e6feffffff60fc8f007745217338fc8f00864521730000000000000000a0fc8f009e53090148fc8f00440000003020a3001020a300801fa3000000000000000000000000000000000000000000000000000000000000000000a8b6d5743b000000b8b6d574cf806f58a0fc8f0089f50901d3701301a8fc8f00e3701301ea701301 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000b8f68f005cf68f00226e2c7400009700000000002d6e2c747da732c42d000000ecb70375e0f68f0000009600b83ca400e08ba3000e0000008000000020f68f0000009600a4f68f0070c82d74d9208fb0feffffff2d000000d0cc12752700000074f68f00856a2e741c233374b4f68f00f85f2e7408000000bb692d74b2692d7495a732c42d000000ecb7037527000000d0cc127588f68f002d000000d0cc127527000000b8f68f00856a2e741c23337400f78f007e8a1175ee8c1175738a11755a320c682d000000ecb7037527000000d0cc12752c119700c01097005a320c68c8f68f00fc524f75b4f78f00e08411756234ce1dfeffffff738a1175 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000916f1db5fffffe7f60f7d300080000006cfed300a0182373cd6beac6feffffff38fed3007745217310fed30086452173000000000000000078fed3008254360120fed300440000005022e3003022e3004421e3000000000000000000000000000000000000000000000000000000000000000000a8b6d57421010000b8b6d5749dffcc1478fed300f5143701d360620180fed300e3606201ea606201 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000e99c697760fed30038f7d300021760e44cfed300a0182373a6ad6cfdfeffffff24fed3001348217378fed300ecfe3601743c63013c91360110fed3004991360108fed300a8086401e0f45a0501fed3003c9136012cfed3004991360124fed300a8086401e8bd590501000000e8bd590578fed300708241014cfed300ed90360178fed300e8bd590578fed30026000000adbd4001c56d620180fed300d56d6201dc6d620121010000146d6201000000000000000001c15c05a8ed3f010277e04201000000 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018000000096f1db500000000c8f6d300a018237334fed300a0182373cd6beac6feffffffe8fdd3005c7f217398fdd3002101000000800000757f217304fed300ffffffffffffffff0c0000000000000004fed300000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff0c0000000000000004fed3000000000091993601200d5a05b994360101000000e4633601000000009a9336010cfed300 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000c570360110fed300e9e1360124fd5a050100000004000000e0325905e83259050000000004000000703c63013c91360101000000701b3f0124fd5a059cfed300e2e0410140fed30004000000a5c6410170fed3000000000024fd5a057fcd410121010000fc7b6201c4e24f018b2f3f01c4e24f0124fd5a05c4e24f01ae000000 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcfc6a77844f6f77b5000000f4fdd30004000000d0fdd3000c000000f8fdd300648607004c01020000000000230000c06e4f6f772101000000000000da4f6f77c4010000000000000c0000001eae6cfd14fed30083a2d674c401000013fed3000000000078fed3008a756101c401000030fed3004c016486000000000000000000000000000000000000f772916b1db5120000006cfed3002030047372703601dda8360168fed300 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000f9761db534e069779eb46cfd8e942273a8e5d3009b942273b73600002c03000000000000b094227300d0a500b736000052613c740857e8004886547400000000827c23a5bce5d300c7963d74000000000857e8004886547401180000bce5d300d2963d74d82f3674501e3d74f9963d7400000000d82f3674dce8e7002ce6d3000857e80000000001000000010000000000000000cf6d6c0c416c65727461626c650000000000000000000000000000000000000000000000020000000100000000010000000700000008000000010000000000000000cf6d6c0c54696d656f75740000000000000000000000000000000000000000000000 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001536) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000752)33:T62c,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "unzip.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "man.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T593,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp")35:T146f,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00000752-00000C17-1280078744 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00000752-00000C17-1280355991 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000752-00000C17-1282311232 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00000752-00000C17-1282353100 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00000752-00000C17-1282446494 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00000752-00000C17-1282465579 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000752-00000C17-1282539801 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000752-00000C17-1282555831 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000752-00000C17-1282556088 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00000752-00000C17-1283328058 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000752-00000C17-1283358896 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000752-00000C17-1283367463 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00000752-00000C17-1283367701 "powershell.exe" queries volume information of "C:\" at 00000000-00000752-00000C17-1283940009 "powershell.exe" queries volume information of "C:\share" at 00000000-00000752-00000C17-1283941230 "powershell.exe" queries volume information of "C:\share" at 00000000-00000752-00000C17-1284114580 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000752-00000C17-1285784413 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000752-00000C17-1286373141 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000752-00000C17-1286525322 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000752-00000C17-1286713092 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00000752-00000C17-1286794089 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll" at 00000000-00000752-00000C17-1286884351 "powershell.exe" queries volume information of "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00000752-00000C17-1286951145 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00000752-00000C17-1287176276 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00000752-00000C17-128720290536:T8c4,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")37:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")38:T43f0,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001536) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00000752) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00000752) "unzip.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003076) "unzip.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003076) "unzip.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003076) "unzip.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003076) "man.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004272) "man.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004272) "man.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004272) "man.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004272) "man.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00004272) "man.exe" called "LoadLibrary" with a parameter wdc.dll (UID: 00000000-00004272)39:T176c5,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetMachineTypeAttributes (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00001536) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeStreamedParameterResultCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_GetInstance (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00000752) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00000752) "unzip.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00003076) "unzip.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00003076) "man.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004272) "man.exe" called "GetProcAddress" with a parameter WdcRunTaskAsInteractiveUser (UID: 00000000-00004272)3a:T57b,WaitForSingleObject@kernel32.dll at 50179-4280-00410F6C Sleep@kernel32.dll at 50179-4515-004242D4 MsgWaitForMultipleObjects at 50179-4525-004A1800 MsgWaitForMultipleObjects at 50179-4531-00410FD4 Sleep@KERNEL32.DLL at 00000000-00001084-52012-114-01095A60 Sleep@KERNEL32.DLL at 00000000-00001084-52012-115-010957C0 Sleep@KERNEL32.DLL at 00000000-00001084-52012-119-01095DE4 Sleep@KERNEL32.DLL at 00000000-00001084-52012-215-010988A0 Sleep@KERNEL32.DLL at 00000000-00001084-52012-220-01098374 Sleep@KERNEL32.DLL at 00000000-00001084-52012-245-01095FDC Sleep@KERNEL32.DLL at 00000000-00001084-52012-2647-01096608 WaitForSingleObject@KERNEL32.DLL at 00000000-00001084-52012-3396-0112099C Sleep@KERNEL32.DLL at 00000000-00001084-52012-3621-0113128C MsgWaitForMultipleObjects at 00000000-00001084-52012-3630-01131800 WaitForSingleObject@KERNEL32.DLL at 00000000-00001084-52012-3884-010B4704 Sleep@KERNEL32.DLL at 00000000-00001084-52012-3887-010B482C WaitForSingleObject@KERNEL32.DLL at 00000000-00001084-52012-3888-010B46F4 Sleep@KERNEL32.DLL at 00000000-00001084-52012-5711-010B42D2 WaitForSingleObject@KERNEL32.DLL at 00000000-00003076-64236-105-004814E0 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00003076-64236-1110-0040C6CE WaitForMultipleObjects@KERNEL32.DLL at 00000000-00003076-64236-1118-0040CE16 WaitForMultipleObjects@KERNEL32.DLL at 00000000-00003076-64236-2364-0045A6563b:T13620,Found reference to API (Indicator: "FreeSid"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegCloseKey"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EqualSid"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FindResourceW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetVersion"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapFree"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CompareStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCPInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFilePointer"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetLastError"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetTickCount"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetProcAddress"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TlsSetValue"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LockResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetErrorMode"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RaiseException"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VirtualFree"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetVersionExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCPInfoExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "lstrlenW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateFileW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateEventW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapDestroy"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LocalAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileSize"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeleteFileW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLocalTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SuspendThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LCMapStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateProcessW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SwitchToThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CloseHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ResetEvent"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VirtualQuery"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ResumeThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TlsGetValue"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ReadFile"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VirtualProtect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FindClose"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RtlUnwind"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ExitProcess"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SizeofResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WriteFile"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetEvent"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "Sleep"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapCreate"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetACP"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LocalFree"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FreeLibrary"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetStdHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ExitThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FormatMessageW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsValidLocale"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLastError"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VariantCopy"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VariantInit"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VariantClear"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VariantChangeType"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SysFreeString"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "PeekMessageW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharNextW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TranslateMessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharLowerBuffW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DestroyWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharUpperW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MessageBoxW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetThreadUILanguage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLongPathNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetTickCount64"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CheckTokenMembership"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetSearchPathMode"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenSCManagerA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenServiceA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetStockObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SelectObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeleteDC"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeleteObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetMapMode"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapQueryInformation"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "K32GetModuleFileNameExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TlsFree"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TlsAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeleteFileA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FlushViewOfFile"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetOEMCP"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinExec"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "Process32FirstW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "Process32NextW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FindNextFileW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LocalReAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TerminateProcess"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetStdHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenProcess"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalFlags"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapSize"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileType"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalFree"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "lstrcmpA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalLock"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "lstrcmpW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SysAllocString"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShellExecuteA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "PathFindExtensionW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ClientToScreen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSysColor"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ReleaseDC"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegisterClassW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "BeginPaint"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "KillTimer"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindowRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMessageTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetTopWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetWindowPos"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "PtInRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCapture"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetKeyState"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetClientRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadIconW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "wsprintfW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RedrawWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetMenuItemBitmaps"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnableWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CopyRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsIconic"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OffsetRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCursorPos"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InvalidateRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDC"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetParent"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetTimer"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShowWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ScreenToClient"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DestroyMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetCursor"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "UpdateWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadCursorW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetScrollPos"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSubMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFocus"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoInitialize"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoUninitialize"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoInitializeSecurity"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFileSecurityW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileSecurityW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FileTimeToDosDateTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetTempPathW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CompareFileTime"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenEventW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFileApisToOEM"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MoveFileW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SysStringLen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharPrevExA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegEnumKeyA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CopyContext"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoGetObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RegFlushKey"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetObjectW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RoundRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDIBits"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetDIBits"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "BitBlt"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "StretchBlt"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TerminateThread"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TransactNamedPipe"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OpenMutexW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WriteProfileStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetProfileStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CopyFileW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MulDiv"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FormatMessageA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreatePipe"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MoveFileExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateMutexW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FreeResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WNetCloseEnum"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WNetEnumResourceW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WNetOpenEnumW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsEqualGUID"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OleInitialize"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CoDisconnectObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OleUninitialize"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetActiveObject"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "OemToCharBuffA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DeleteMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CopyImage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetIconInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FillRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShowCaret"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateIconIndirect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetFocus"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WaitMessage"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DrawIconEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetKeyNameTextW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharToOemBuffA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnableScrollBar"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetScrollRange"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ScrollWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateIcon"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "FrameRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDCEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetScrollRange"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DrawEdge"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetParent"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsZoomed"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetCapture"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "RemoveMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "AppendMenuW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "LoadImageW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DestroyCursor"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "InsertMenuW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetCursorPos"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DrawIcon"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "DestroyIcon"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsChild"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "HideCaret"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MoveWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetScrollPos"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CreateMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "PeekMessageA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetWindowDC"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetMenuState"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "MessageBeep"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetCursor"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SendMessageA"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CharLowerW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "ShowOwnedPopups"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpSetStatusCallback"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpWriteData"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpSetCredentials"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpQueryOption"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "WinHttpSetOption"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "StrToInt64ExW"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API (Indicator: "GetLargePageMinimum"; File: "00000000-00003076.00000000.148666.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "00000000-00003076.00000000.148666.00401000.00000020.mdmp") Found reference to API (Indicator: "K32GetProcessMemoryInfo"; File: "00000000-00003076.00000000.148666.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; File: "00000000-00003076.00000000.148666.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00000752.00000001.148312.00F11000.00000020.mdmp, 00000000-00000752.00000001.148312.71F81000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000752.00000001.148312.00F11000.00000020.mdmp, 00000000-00000752.00000001.148312.71F81000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000752.00000001.148312.00F11000.00000020.mdmp, 00000000-00000752.00000001.148312.71F81000.00000020.mdmp")3c:T423,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000752.00000000.147779.00F21000.00000002.mdmp, 00000000-00000752.00000001.148312.71F95000.00000002.mdmp")3d:T19dd,"Software\Embarcadero\Locales" in Source: 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe "Software\CodeGear\Locales" in Source: 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe "Software\Borland\Locales" in Source: 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe "Software\Borland\Delphi\Locales" in Source: 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 63440-159-00F1D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 63440-194-00F18190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 63440-194-00F18190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 63440-194-00F18190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 63440-196-00F1BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 63440-207-00F18AF0 "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00000752.00000000.147779.030A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000752.00000000.147779.030A0000.00000004.mdmp 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000752.00000000.147779.030A0000.00000004.mdmp 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00000752.00000001.148312.07660000.00000004.mdmp 00000000-00000752.00000001.148312.07735000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000752.00000001.148312.08C90000.00000004.mdmp3e:Tc15,Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1084:168:WilStaging_02" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1084:168:WilStaging_02" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe created mutex with name "SM0:1084:168:WilStaging_02" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe created mutex with name "Local\SM0:1084:168:WilStaging_02" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1536:168:WilStaging_02" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1536:64:WilError_01" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "Local\SM0:1536:168:WilStaging_02" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process 7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp created mutex with name "SM0:1536:64:WilError_01" Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:752:168:WilStaging_02" Process powershell.exe created mutex with name "SM0:752:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:752:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:752:64:WilError_01" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:752:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:752:64:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:752:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:752:64:WilError_01"3f:T1280,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]40:T1de9,"th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00000752.00000000.147779.030A0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000752.00000000.147779.030A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000752.00000000.147779.030A0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00000752.00000000.147779.05130000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00000752.00000001.148312.00F11000.00000020.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{E7D35CFA-348B-485E-B524-252725D697CA}" in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}" in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{7C857801-7381-11CF-884D-00AA004B2E24}" in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000752.00000001.148312.030A0000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00000752.00000001.148312.07660000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00000752.00000001.148312.07735000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000752.00000001.148312.08C90000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00001084.00000000.147480.01091000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00001084.00000000.147480.01091000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00001084.00000000.147480.01091000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00001084.00000000.147480.01091000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001084.00000000.147480.01091000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00001536.00000000.147576.00E30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001536.00000000.147576.00E30000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00001536.00000000.147576.72DA1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00001536.00000000.147576.72DA1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00001536.00000000.147576.72DA1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00001536.00000000.147576.72DA1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00004272.00000000.148997.00F38000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00004272.00000000.148997.00F38000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00004272.00000000.148997.00F38000.00000002.mdmp "Software\Classes\" in Source: 00000000-00004272.00000000.148997.00F38000.00000002.mdmp "Software\" in Source: 00000000-00004272.00000000.148997.00F38000.00000002.mdmp41:T4e04,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "KERNEL32" at base 74880000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73190000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "KERNEL32.DLL" at base 74880000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75010000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "RPCRT4.DLL" at base 74ea0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b10000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "NTDLL.DLL" at base 77640000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73fb0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "KERNEL32" at base 74880000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73190000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "KERNEL32.DLL" at base 74880000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "MSCTF.DLL" at base 74ac0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "IMM32.DLL" at base 74c20000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b10000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "WTSAPI32.DLL" at base 73cd0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "NTDLL.DLL" at base 77640000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "RPCRT4.DLL" at base 74ea0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "UXTHEME.DLL" at base 73b10000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75010000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 72eb0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 72e80000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76840000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "COMCTL32" at base 72f70000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "COMCTL32.DLL" at base 72f70000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "USER32.DLL" at base 766c0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74fc0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72da0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "OLEAUT32.DLL" at base 76620000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 766c0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 766c0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74340000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74ac0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74780000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "SSPICLI.DLL" at base 74060000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "DWMAPI.DLL" at base 73280000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 5430000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 724c0000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72480000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76430000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72400000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72350000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72340000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72280000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74c50000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73280000 "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73fb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c50000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c50000 "powershell.exe" loaded module "KERNEL32" at base 74880000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73190000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74880000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 76430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72170000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 74fc0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 77540000 "powershell.exe" loaded module "VERSION.DLL" at base 73d90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71370000 "powershell.exe" loaded module "USER32.DLL" at base 766c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72200000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74340000 "powershell.exe" loaded module "PSAPI.DLL" at base 74270000 "powershell.exe" loaded module "RPCRT4.DLL" at base 74ea0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 6ff60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 74780000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 76620000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72070000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76840000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71fe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ece0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 74340000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 74340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77640000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 76380000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76380000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 773b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e560000 "powershell.exe" loaded module "AMSI.DLL" at base 71fd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73d90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 71f80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\Z8TG5787.DLL" at base 71f20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 71ea0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 773b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6de20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 74340000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 71e50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71d40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 71d30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 74060000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 71d10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b10000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e4c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74880000 "powershell.exe" loaded module "USERENV.DLL" at base 71fa0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76430000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 71cb0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 71c90000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74880000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e490000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e300000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73950000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "MSISO.DLL" at base 6e290000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6dd70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 733e0000 "powershell.exe" loaded module "OLEAUT32" at base 76620000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 74280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e280000 "powershell.exe" loaded module "MI.DLL" at base 6da80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6d9f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72400000 "powershell.exe" loaded module "GDI32.DLL" at base 76350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72340000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 72280000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 74c50000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 74c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 74880000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 74c50000 "unzip.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c50000 "unzip.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c50000 "unzip.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c50000 "unzip.exe" loaded module "KERNEL32" at base 74880000 "unzip.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73190000 "unzip.exe" loaded module "RPCRT4.DLL" at base 74ea0000 "man.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c50000 "man.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c50000 "man.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c50000 "man.exe" loaded module "KERNEL32" at base 74880000 "man.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73190000 "man.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 74c50000 "man.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b10000 "man.exe" loaded module "NTDLL.DLL" at base 77640000 "man.exe" loaded module "USER32.DLL" at base 766c0000 "man.exe" loaded module "WDC.DLL" at base 73040000 "man.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73520000 "man.exe" loaded module "RPCRT4.DLL" at base 74ea0000 "man.exe" loaded module "SSPICLI.DLL" at base 74060000 "man.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7488000042:T7ef,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" was detected as "Inno Setup Module" and name: "Installer" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" was detected as "Turbo Linker" and name: "Linker" "man.exe" was detected as "Inno Setup Module" and name: "Installer" "man.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "man.exe" was detected as "Turbo Linker" and name: "Linker" "kail.exe" was detected as "Inno Setup Module" and name: "Installer" "kail.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "kail.exe" was detected as "Turbo Linker" and name: "Linker" "NVIDIA.exe" was detected as "Inno Setup Module" and name: "Installer" "NVIDIA.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "NVIDIA.exe" was detected as "Turbo Linker" and name: "Linker" "bypass.exe" was detected as "Inno Setup Module" and name: "Installer" "bypass.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "bypass.exe" was detected as "Turbo Linker" and name: "Linker" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" was detected as "Inno Setup Module" and name: "Installer" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" was detected as "Turbo Linker" and name: "Linker" "is-HINRB.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-HINRB.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-HINRB.tmp" was detected as "Turbo Linker" and name: "Linker" "_setup64.tmp" was detected as "Inno Setup Module" and name: "Installer" "_setup64.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "_setup64.tmp" was detected as "Turbo Linker" and name: "Linker"43:Tc05,Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found string "foreach($resolvedPath in (Resolve-Path @PSBoundParameters))" (Indicator: "Resolve-Path"; Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp, 00000000-00000752.00000001.148312.07660000.00000004.mdmp")44:Tcfb,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "man.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}")45:T6bf,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" has an writable section named ".data" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" has an writable section named ".bss" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" has an writable section named ".idata" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" has an writable section named ".didata" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" has an writable section named ".tls" "man.exe" has an writable section named ".data" "kail.exe" has an writable section named ".data" "kail.exe" has an writable section named ".sxdata" "NVIDIA.exe" has an writable section named ".xxxx" "NVIDIA.exe" has an writable section named ".oooo" "NVIDIA.exe" has an writable section named ".rsrc" "bypass.exe" has an writable section named ".xxxx" "bypass.exe" has an writable section named ".oooo" "bypass.exe" has an writable section named ".code" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" has an writable section named ".data" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" has an writable section named ".bss" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" has an writable section named ".idata" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" has an writable section named ".didata" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" has an writable section named ".tls" "is-HINRB.tmp" has an writable section named ".data" "is-HINRB.tmp" has an writable section named ".sxdata" "_setup64.tmp" has an writable section named ".data"46:T152c,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x5c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x3c], eax,mov dword ptr [ebp - 0x40], eax,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x30], eax,mov dword ptr [ebp - 0x38], eax,mov dword ptr [ebp - 0x34], eax,mov dword ptr [ebp - 0x2c], eax,mov dword ptr [ebp - 0x28], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4a31d4,call 0x40fd3c,xor eax, eax,push ebp,push 0x4a869d,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x4a8657,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x4b0634],call 0x4a19f4,call 0x4a154c,lea edx, [ebp - 0x14],xor eax, eax," "man.exe" file has an entrypoint instructions - "call 0x4249ad,jmp 0x423ee1,cmp ecx, dword ptr [0x45f540],jne 0x424076,ret ,jmp 0x424324,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x40f974,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x44ce10,je 0x4240a5,push 0xc,push esi,call 0x42407b,pop ecx,pop ecx,mov eax, esi,pop esi,pop ebp,ret 4,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6]," "kail.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4941b0,push 0x485378,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x48d154],pop ecx,or dword ptr [0x4a7494], 0xffffffff,or dword ptr [0x4a7498], 0xffffffff,call dword ptr [0x48d158],mov ecx, dword ptr [0x4a3450],mov dword ptr [eax], ecx,call dword ptr [0x48d15c],mov ecx, dword ptr [0x4a344c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x48d160],mov eax, dword ptr [eax]," "NVIDIA.exe" file has an entrypoint instructions - "push ebp,mov esi, 0x441000,lea edi, [esi - 0x40000],lea eax, [edi + 0x55804],push dword ptr [eax],mov dword ptr [eax], 0xb1cca3d3,push eax,push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x4635b7,inc esi,inc esi,push ebx,push 0x61228,push edi,add ebx, 4,push ebx,push 0x2257f,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0," "bypass.exe" file has an entrypoint instructions - "push ebp,mov esi, 0x415000,lea edi, [esi - 0x14000],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x421e48,inc esi,inc esi,push ebx,push 0x1ff1a,push edi,add ebx, 4,push ebx,push 0xce28,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax," "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x6bd170,call 0x411d70,xor eax, eax,push ebp,push 0x6cfa28,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x4156d8,call 0x6bced4,mov eax, dword ptr [0x6bcdc4],push eax,push 0x6bce5c,mov eax, dword ptr [0x6d99cc],mov eax, dword ptr [eax],call 0x5ab98c,mov eax, 0x6b7304,mov edx, dword ptr [0x6d9844],mov dword ptr [edx], eax,mov eax, dword ptr [0x6d992c],mov dword ptr [eax], 1,push 0,mov eax, dword ptr [0x6d99cc]," "is-HINRB.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4941b0,push 0x485378,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x48d154],pop ecx,or dword ptr [0x4a7494], 0xffffffff,or dword ptr [0x4a7498], 0xffffffff,call dword ptr [0x48d158],mov ecx, dword ptr [0x4a3450],mov dword ptr [eax], ecx,call dword ptr [0x48d15c],mov ecx, dword ptr [0x4a344c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x48d160],mov eax, dword ptr [eax]," "_setup64.tmp" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400012a4,mov ecx, eax,call qword ptr [rip + 0xb8f],int3 ,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,"47:T82f,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")48:Teb1,Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00001084-00000C2B-1274286848] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001536-00000C2B-1275974956] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00001536-00000C2B-1276261865] Observed system executable string:"%WINDIR%\system32\Rstrtmgr.dll" [Source: 00000000-00001536-00000C2B-1276326896] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00001536-00000C2B-1276592982] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00001536-00000C2B-1277316178] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000752-00000C2E-974282316] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000752-00000C2B-1279273948] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000752-00000C2B-1279395936] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000752-00000C2B-1279589769] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000752-00000C2B-1279784145] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000752-00000C2B-1279811670] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000752-00000C2B-1279867154] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00000752-00000C2B-1279983162] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000752-00000C2B-1280177496] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00000752-00000C2B-1280231955] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000752-00000C2B-1280466554] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000752-00000C2B-1280529338] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00000752-00000C2B-1280597374] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00000752-00000C2B-1280756374] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00000752-00000C2B-1281049301] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000752-00000C2B-1281244015] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000752-00000C2B-1281256653] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000752-00000C2B-1281487572] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00000752-00000C2B-1281521283]49:T7ec,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "function Import-PowerShellDataFile" (Indicator: "Import-PowerShellDataFile"; Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp, 00000000-00000752.00000001.148312.07660000.00000004.mdmp")4a:T8f4,"man.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%PUBLIC%\Documents\man.exe]- [targetUID: 00000000-00004272] "kail.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%PUBLIC%\Documents\WindowsData\kail.exe]- [targetUID: 00000000-00004272] "NVIDIA.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 3 sections"- Location: [%PUBLIC%\Documents\WindowsData\NVIDIA.exe]- [targetUID: 00000000-00004272] "bypass.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 3 sections"- Location: [%PUBLIC%\Documents\WindowsData\bypass.exe]- [targetUID: 00000000-00004272] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00000752] "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-TBCC0.tmp\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp]- [targetUID: 00000000-00001536] "is-LIJDV.tmp" has type "7-zip archive data version 0.4"- Location: [%PUBLIC%\Documents\is-LIJDV.tmp]- [targetUID: 00000000-00001536] "is-HINRB.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 5 sections"- Location: [%PUBLIC%\Documents\is-HINRB.tmp]- [targetUID: 00000000-00001536] "me.key" has type "Zip archive data made by v2.3 MVS extract using at least v2.0 last modified last modified Sun Jul 11 2020 22:40:26 uncompressed size 266704 method=deflate"- Location: [%PUBLIC%\Documents\WindowsData\me.key]- [targetUID: 00000000-00004272] "is-MIQ89.tmp" has type "data"- Location: [%PUBLIC%\Documents\is-MIQ89.tmp]- [targetUID: 00000000-00001536] "windows.log" has type "data"- Location: [%PUBLIC%\Documents\WindowsData\windows.log]- [targetUID: 00000000-00004272] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00000752] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-9AA6S.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00001536]4b:T77b,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")4c:Tfde,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "7DE5F5F6F3B17C99C97B37C3BE788952CE01B7D2437E2139B344318AF580D023.EXE"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: """; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "7DE5F5F6F3B17C99C97B37C3BE788952CE01B7D2437E2139B344318AF580D023"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")4d:T4d9,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution (Powershell command string) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to delay the execution of current thread4e:Taec,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp\FLTLIB.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp\CRYPTSP.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\UNZIP.EXE" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\unzip.exe" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp\POWERSHELL.EXE" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp\powershell.exe" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\SysWOW64\POWERSHELL.EXE" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\SysWOW64\powershell.exe" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\WINDOWS\SYSTEM32\powershell.exe" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\System\POWERSHELL.EXE" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\WINDOWS\system\powershell.exe"4f:Tb32,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-TBCC0.TMP" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp\7DE5F5F6F3B17C99C97B37C3BE788952CE01B7D2437E2139B344318AF580D023.TMP.LOCAL" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-9AA6S.TMP" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-9AA6S.tmp" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-TBCC0.tmp\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp.Local\" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\IS-HINRB.TMP" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\is-HINRB.tmp" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\MAIN.XML" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\main.xml" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\IS-LIJDV.TMP" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\is-LIJDV.tmp" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\SERVER.LOG" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\Server.log" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\IS-MIQ89.TMP" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\is-MIQ89.tmp" "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" trying to access non-existent file "C:\Users\Public\Documents\WINDOWSDATA"50:T55c,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe")51:Tc83,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe")52:T41a,"3.30.5.0" Potential IP "6.4.0.1" found in string "Inno Setup Setup Data (6.4.0.1)" "2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.4.3" "2.5.29.15" "2.5.29.19" "2.5.29.32" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.1" "2.5.29.14" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of errors to retain in a sessionion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "2.5.29.10" Potential IP "4.0.0.0" found in string "n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" "2.5.29.16" "2.5.4.10" "2.5.4.6" "2.5.4.8" "2.5.4.7" "2.5.4.5" "2.5.4.11" Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" "1.0.0.190" "11.10.3.6"53:T1c28,Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "em.ma" Heuristic match: "ement.au" Pattern match: "www.digicert.com1" Heuristic match: "ndows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1$0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "ntrust.net" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623621" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623636" Pattern match: "http://www.microsoft.com/win" Heuristic match: "0.16299.15.cat" Heuristic match: "windows-defender-management-powershell-group-wow64-package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://www" Pattern match: "ft.com/powershell" Pattern match: "http://www.micro" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "https://connect.microsoft.com/powershell/feedback/details/421837" Pattern match: "http://pesterbdd.com/images/pester.png" Pattern match: "https://github.com/pester/pester" Pattern match: "http://www.apache.org/licenses/license-2.0.html" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Pattern match: "www.microsoft.com/"54:T5459,Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00000752.00000000.147779.00D30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000752.00000000.147779.00D30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000752.00000000.147779.00D30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000752.00000000.147779.03181000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000752.00000000.147779.03181000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000752.00000000.147779.03181000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000752.00000000.147779.03181000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000752.00000000.147779.03181000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ydigicert" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/_logonserver=\\desktop-fvvf82aprocessor_architecture=x86allusersprofile=c:\programdatapscreatehashcomputername=desktop-fvvf82a2.5.29.10pkcsentrust," - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l?azhmnp(knppoppxs" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?washington1redmond1microsoft" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn$npwitxpit2" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000752.00000000.147779.07660000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00000752.00000001.148312.03181000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00000752.00000001.148312.03181000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00000752.00000001.148312.03181000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00000752.00000001.148312.03181000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00000752.00000001.148312.03181000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;;" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0com/_" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l?azhmnp(knppoppxs" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?washington1redmond1microsoft" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!$%'%;qnameprop;qnameprop;qnameprop" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://wwwft.com/powershell" - Source: "00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbrhttp://www.micro/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000752.00000001.148312.07726000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0,iks" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "https://connect.microsoft.com/powershell/feedback/details/421837" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "http://pesterbdd.com/images/pester.png" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "https://github.com/pester/pester" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0.html" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000752.00000001.148312.08C90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0000000000000l*:ql*:ql*:q?azh" - Source: "00000000-00000752.00000001.148312.08D03000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(" - Source: "00000000-00000752.00000001.148312.08D03000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00000752.00000001.148312.08D03000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00000752.00000001.148312.08D03000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0y,mbr" - Source: "00000000-00000752.00000001.148312.71F81000.00000020.mdmp") Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00001084.00000000.147480.01091000.00000020.mdmp")55:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp")56:T480,Found registry query API: "RegOpenKeyExW" in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" Found registry query API: "RegQueryValueExW" in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" Found registry query API: "RegEnumValueW" in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" Found registry query API: "RegEnumKeyW" in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" Found registry query API: "RegQueryValueW" in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" Found registry query API: "RegEnumKeyA" in file "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" Found registry query API: "RegQueryValueExW" in "00000000-00000752.00000000.147779.00F21000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00000752.00000000.147779.00F21000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000752.00000000.147779.00F21000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000752.00000000.147779.00F21000.00000002.mdmp"57:Tdbd,"7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "FindFirstFileW" with parameter C:\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.en-US (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "FindFirstFileW" with parameter C:\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.en (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "FindFirstFileW" with parameter C:\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.ENU (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.exe" called "FindFirstFileW" with parameter C:\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.EN (UID: 00000000-00001084) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindFirstFileW" with parameter %TEMP%\is-TBCC0.tmp\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.en-US (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindFirstFileW" with parameter %TEMP%\is-TBCC0.tmp\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.en (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindFirstFileW" with parameter %TEMP%\is-TBCC0.tmp\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.ENU (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindFirstFileW" with parameter %TEMP%\is-TBCC0.tmp\7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.EN (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindFirstFileW" with parameter %TEMP%\is-9AA6S.tmp\* (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindNextFileW" with parameter .. (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindNextFileW" with parameter _isetup (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindFirstFileW" with parameter %TEMP%\is-9AA6S.tmp\_isetup\* (UID: 00000000-00001536) "7de5f5f6f3b17c99c97b37c3be788952ce01b7d2437e2139b344318af580d023.tmp" called "FindNextFileW" with parameter _setup64.tmp (UID: 00000000-00001536) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000752) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00000752) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00000752)58:T13eb,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00000752.00000001.148312.00F11000.00000020.mdmp") Found string "7zAES" (Indicator: "aes"; File: "00000000-00003076.00000000.148666.00401000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000000.147779.07660000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000752.00000000.147779.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.030A0000.00000004.mdmp, 00000000-00000752.00000001.148312.07660000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00000752.00000000.147779.05130000.00000004.mdmp") Found string "[-WindowStyle