26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 7c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL/Spy.AgentTesla Sample deb95b23dbb4… — Score 57/100 — Hybrid Analysis","description":"Malicious verdict for sample deb95b23dbb4…. Malware family: MSIL/Spy.AgentTesla. Threat score 57/100. 4/26 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8","keywords":["Malicious","MSIL/Spy.AgentTesla","malware analysis","sandbox report","threat intelligence","deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8"],"about":{"@type":"SoftwareApplication","name":"ps_tUpdFkOTMXCj_1774368426057.ps1","applicationCategory":["powershell","ps"],"identifier":"deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8","additionalType":"Malicious sample"},"threatScore":57,"malwareFamily":"MSIL/Spy.AgentTesla","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb67,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{A63293E8-664E-48DB-A079-DF759E0509F7}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{82A74AEB-AEB4-465C-A014-D097EE346D63}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{F26305EF-6948-40B9-B255-81453D09C785}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{43668BF8-C14E-49B2-97C9-747784D784B7}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{7E636BFE-DFA9-4D5E-B456-D7B39851D8A9}\PROPERTYBAG") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\PROPERTYBAG") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\DELEGATEFOLDERS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DELEGATEFOLDERS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS")28:Ta0d,"powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-952019546 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-952028973 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-952898177 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-952907711 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-955125370 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-955133974 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-955308573 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-955318537 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-956095640 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-957050830 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-957074672 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-957576845 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-957586970 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964214157 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964771422 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964780578 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964789055 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964797713 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964804967 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964813630 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964821078 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964829622 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964837208 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-964845918 [PID: 7692] "powershell.exe" queried SystemProcessInformation at 00000000-00007692-00000C15-971057245 [PID: 7692]29:T4c7,Process "WerFault.exe" [UID: 00000000-00006884] Process "WerFault.exe" [UID: 00000000-00004236] Process "WerFault.exe" [UID: 00000000-00003716] Process "WerFault.exe" [UID: 00000000-00004532] Process "WerFault.exe" [UID: 00000000-00007560] Process "WerFault.exe" [UID: 00000000-00003636] Process "WerFault.exe" [UID: 00000000-00007900] Process "WerFault.exe" [UID: 00000000-00007876] Process "WerFault.exe" [UID: 00000000-00004348] Process "WerFault.exe" [UID: 00000000-00008880] Process "WerFault.exe" [UID: 00000000-00005560] Process "WerFault.exe" [UID: 00000000-00006120] Process "WerFault.exe" [UID: 00000000-00005232] Process "WerFault.exe" [UID: 00000000-00009096] Process "WerFault.exe" [UID: 00000000-00004312] Process "WerFault.exe" [UID: 00000000-00005524] Process "WerFault.exe" [UID: 00000000-00005640] Process "WerFault.exe" [UID: 00000000-00008356] Process "WerFault.exe" [UID: 00000000-00005688] Process "WerFault.exe" [UID: 00000000-00009172] Process "WerFault.exe" [UID: 00000000-00008796] Process "WerFault.exe" [UID: 00000000-00005496] Process "WerFault.exe" [UID: 00000000-00009176] Process "WerFault.exe" [UID: 00000000-00007960] Process "WerFault.exe" [UID: 00000000-00005136]2a:T49e,"powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "f0bb073ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "107d083ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "1065083ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "107e083ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "1074083ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextA" with parameters {"phProv": "107b083ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "30eb763ca1010000" "dwProvType": "1" "dwFlags": "4026531840"} "powershell.exe" called "CryptAcquireContextW" with parameters {"phProv": "3008773ca1010000" "szProvider": "Microsoft Enhanced RSA and AES Cryptographic Provider" "dwProvType": "24" "dwFlags": "4026531840"}2b:T1359,"powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a03e073ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2037073ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "303c073ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "@N<" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "804d093ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a04b093ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "1035073ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "c03f073ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20f20b3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0ec0b3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "703a103ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b039103ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "0038103ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "7037103ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "203c0f3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20330f3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "20360f3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d0370f3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0330f3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "50330f3ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "a0ef113ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b0ee113ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a121a9cda0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "e0f7113ca1010000" "pbInput": "RSA1" "cbInput": "163" "dwFlags": "0"} "powershell.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "1a13c09a460" "pszBlobType": "RSAPUBLICBLOB" "phKey": "804b0f3ca1010000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}2c:T23b8,"powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "6084b121a1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d07db121a1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "3082b121a1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "@~"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c087d10" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0ec093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c087d10" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "80e3093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c087d10" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70e0093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "b0ec093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "00e0093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10e3093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70e7093ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50e2113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "70e8113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "30ea113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c07bbf0" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "d0e5113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c087d10" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "10eb113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c086510" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50e9113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c086510" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "20e7113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c086510" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "60e5113ca1010000"} "powershell.exe" called "CryptImportKey" with parameters {"hProv": "1a13c087e10" "pbData": "0602000000240000525341310004000001000100b5fc90e7027f67871e773a8fde8938c81dd402ba65b9201d60593e96c492651e889cc13f1415ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f74750e5975c64e2189f45def46b2a2b1247adc3652bf5c308055da9" "dwDataLen": "148" "dwFlags": "0" "phKey": "50e9113ca1010000"}2d:T38f4,"powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac1318ff7f0000000000000000000051ed6c1aff7f000000000000a101000000000000000000009e4e4f8614f700002a0000000000000020bea421a10100008fec6c1aff7f0000e0ac1318ff7f0000e0ac1318ff7f0000000000000000000000000000ff7f0000ffffff7f75c7000000000000000000000000000000000000d8ce0718ff7f00002a0000000000000069c3c017ff7f0000310000000000000058020000000000005c02000000000000110001100000000050dbcec83000000003a3b019ff7f000050dbcec83000000000000000000000002b00000000000000000000000000000020b0c617ff7f0000b43fc517ff7f0000e0ce0718 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000001000000000000000b000000000000000b0000000000000058000000000000000000000000000000000000000000000000000e00000000000e00000001000000000000000000000000000000000000000b0000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000360d00000000000030d3cec83000000004000000000000007068d8587001000006000000000000000300000000000000a7408317ff7f00000000000000000000000000000000000000000000000000000101000000000000803ca721a10100000a000000000000000000000000000000000000000000000043003a005c00550073006500720073000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004986a1aff7f00000000000000000000000000000000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000a0119521a1010000000000000000000000009521a101000000e0e0c830000000000000000000000000000000000000000000000000000000000000000000000028002a0000000000c00c9521a10100002a000000000000004000000000000000d0cbcec83000000000000000000000000000000000000000000000000000000000000000000000000400000000000000200d9521a1010000000000000000000000009521a101000000e0e0c83000000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffffa101000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000e0e0c83000000040000000000000000000000000000000320000000000000000000000000000000000000000000000ffffffffa10100000000000000000000000000000000000070cca521a101000010dfcec830000000646fa521a1010000f0aba721a1010000000000000000000000000000000000000000000000000000000000000000000000000000000000009071a521a1010000a471a521a10100009071a521a1010000feffffffffffffff0000000000000000b2fea421a1010000000000000000000000000000000000000000000000000000a0cccec8300000003200000000000000d0cbcec830000000f0cbcec83000000000000051 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000fa0c00000000000070b6cec830000000b827c84ece7f00006019d758700100001affff7f000000002000000000000000a7408317ff7f0000b0c3cec830000000000000000000000098bdcec830000000e30000000000000010c6a521a10100002b0000000000000020bdcec8987880574f8c6244bb63710443003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f006600740000000000cd0b000098bdcec8300000000000000004986a1aff7f00000000000000000000000000000000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000060189521a1010000000000000000000000009521a101000000e0e0c83000000000000000000000000000000000000000000000000000000000000000000000006c006e0000000000c00c9521a10100000f00000000000000800000000000000010afcec83000000000000000000000000000000000000000000000000000000000000000000000000800000000000000e0139521a1010000000000000000000000009521a101000000e0e0c83000000040000000000000000000000000000000760000000000000000000000000000000000000000000000ffffffffa101000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000000000000000000070cca521a101000050c2cec8300000001870a721a101000000eda721a101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff0000000000000000f6fea421a1010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000d60c00000000000010a8cec830000000f435c84ece7f000020edd858700100002cffff7f000000003200000000000000a7408317ff7f0000000000000000000000000000000000000000000000000000d1000000000000009071a521a10100003e000000000000000000000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e00750000000000000004000105 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000e0169521a1010000000000000000000000009521a101000000e0e0c83000000000000000000000000000000000000000000000000000000000000000000000009200940000000000c00c9521a10100001000000000000000b000000000000000b0a0cec83000000000000000000000000000000000000000000000000000000000000000000000000b00000000000000e0169521a1010000000000000000000000009521a101000000e0e0c83000000040000000a101000000000000000000009c0000000000000000000000000000000000000000000000ffffffffa101000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000c00c000000000000e0a0cec8300000000e3dc84ece7f000070d7d6587001000037ffff7f000000003d00000000000000a7408317ff7f0000b0a0cec830000000d0a0cec8300000000024a82102000000c600000000000000c092a621a101000047000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000060159521a1010000000000000000000000009521a101000000e0e0c8300000000000000000000000000000000000000000000000000000000000000000000000a400a60000000000c00c9521a10100000400000000000000c0000000000000008099cec83000000000000000000000000000000000000000000000000000000000000000000000000c0000000000000060159521a1010000000000000000000000009521a101000000e0e0c83000000040000000000000000000000000000000ae0000000000000000000000000000000000000000000000ffffffffa101000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ae0c000000000000b099cec8300000002c44c84ece7f000070bbd8587001000040ffff7f000000004600000000000000a7408317ff7f00008099cec830000000a099cec8300000000000005602000000bd000000000000009002a621a10100005a000000000000000200000000000000000000000000000043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c0052006f0061006d0069006e0067005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c005300740061007200740020004d0065006e0075005c00500072006f006700 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000020202072000000000004093cec830000000ffffffffffffffff01000000000000006c93cec830000000000000003307020233072e0000000000f5000000000000000000000000000000207feba6433800003400003400000000ca00cc0000000000ffffffff000000000004000000000000983c691aff7f00004092cec8300000004093cec830000000ffffffff0000000000000000000000004092cec830000000e6748217ff7f00007f00000000000000000400000000000000009521a101000000e0e0c8300000004093cec830000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffa101000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000000e0e0c8300000004093cec830000000ffffffff00000000000000000000000000000000000000000000000000000000ffffffffa10100000000000000000000000000000000000070cca521a101000090a5cec830000000489aa721a10100001030a821a101000000000000000000000000000000000000000000000000000000000000000000000d000000000000006800000000000000c898a721a1010000b098a721a1010000feffffffffffffff200000000100000054ffa421a101000000000000000000000d0000000000000000000000000000000000000000000000d400000000000000570069006e0064006f00770073002000ede9ffff (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005029a821a10100007028a821a1010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000105000000000000000000000000000000000000000000000000000000000030a821a10100005029a821a10100000000000000000000ffffffffff7f000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000006fa6a721a1010000ff030000000000006fa6a721a1010000070000070000000000000000000000000200000200000000010000004d006900630072006f0073006f006600740000005021a821a1010000d749ea16ff7f000000000000000000001024a821a1010000ea1600fc00000000b0b0cec830000000ea1600fca10100002700000000000000ea16000000000000d956c2ed503d00000000000000000000000000000000000000000000000000000035e616ff7f0000102fa821a1010000d6676a1aff7f00002c17003ba101000062878417ff7f000000000000000000000000a221a10100000000000000000000ffffffffa101000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a6a1aff7f00000000a221a1010000000000000000000000000000000000000000a221a1010000f95cc2ed503d0000d6676a1aff7f0000efbe0000000000004874a521a1010000e06da521a10100004874a521a101000000000000000000005811a821a101000078afcec830000000b49de516ff7f000060c2a521a1010000d6676a1aff7f0000ffffffff0000000080bba721a101000000000000000000000000000000000000010000000000000000000000000000002010a821a10100009c96e616ff7f0000c047a721a10100000c00000000000000080000000000000031d4c419ff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a6a1aff7f00000000a221a1010000000000000000000000000000000000000000a221a1010000f95cc2ed503d0000d6676a1aff7f0000efbe000000000000c86fa521a1010000e06da521a1010000c86fa521a10100000000000000000000b813a821a101000078afcec830000000b49de516ff7f000060c2a521a1010000d6676a1aff7f0000ffffffff0000000070c1a721a101000000000000000000000000000000000000010000000000000000000000000000008012a821a10100009c96e616ff7f0000c047a721a10100000c00000000000000080000000000000031d4c419ff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a6a1aff7f00000000a221a1010000000000000000000000000000000000000000a221a1010000f95cc2ed503d0000d6676a1aff7f0000efbe000000000000c878a521a1010000e06da521a1010000c878a521a10100000000000000000000c815a821a101000078afcec830000000b49de516ff7f000060c2a521a1010000d6676a1aff7f0000ffffffff0000000010b8a721a101000000000000000000000000000000000000010000000000000000000000000000009014a821a10100009c96e616ff7f0000c047a721a10100000c00000000000000080000000000000031d4c419ff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007692) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a6a1aff7f00000000a221a1010000000000000000000000000000000000000000a221a1010000f95cc2ed503d0000d6676a1aff7f0000efbe000000000000c878a521a1010000e06da521a1010000c878a521a10100000000000000000000b856a821a101000078afcec830000000b49de516ff7f00004075a421a1010000d6676a1aff7f0000ffffffff0000000090bfa721a101000000000000000000000000000000000000010000000000000000000000000000008055a821a10100009c96e616ff7f0000c047a721a10100000c00000000000000080000000000000031d4c419ff7f00000000000000000000ffffffff0000000000000000 (UID: 00000000-00007692)2e:T8e2,"powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007692-00000C17-952754024 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007692-00000C17-952772446 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007692-00000C17-952776861 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007692-00000C17-955785111 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00007692-00000C17-956508786 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00007692-00000C17-956874445 "powershell.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007692-00000C17-957217332 "powershell.exe" queries volume information of "C:\share" at 00000000-00007692-00000C17-957219245 "powershell.exe" queries volume information of "C:\share" at 00000000-00007692-00000C17-957305434 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007692-00000C17-959745172 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007692-00000C17-959882809 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007692-00000C17-960015345 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00007692-00000C17-9639047672f:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")30:T3128,"powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\diasymreader.dll (UID: 00000000-00007692) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007692)31:T967a,"powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter IsWindowVisibleW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessesW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter TerminateProcessW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007692) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007692)32:Tc29,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]33:T1e72,"powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff177f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff177f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff177f0000 "powershell.exe" loaded module "KERNEL32" at base 7fff19b80000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffef7f70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff15010000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7fff16d80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7fff00c10000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7fff19b80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fff13050000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7fff1a530000 "powershell.exe" loaded module "NTDLL.DLL" at base 7fff1a680000 "powershell.exe" loaded module "CSCAPI.DLL" at base 7fff09610000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff16d00000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7fff19f80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffef7e10000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 1a1232c0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7fff169d0000 "powershell.exe" loaded module "VERSION.DLL" at base 7fff0ec20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffee8450000 "powershell.exe" loaded module "USER32.DLL" at base 7fff193e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7fff177f0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7fff04060000 "powershell.exe" loaded module "NTDLL" at base 7fff1a680000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7fff1a060000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffee6e50000 "powershell.exe" loaded module "OLE32.DLL" at base 7fff19c40000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7fff1a060000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7fff19d90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffee61e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffee5760000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fff07e40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff15e70000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffee36f0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7fff1a060000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7fff1a060000 "powershell.exe" loaded module "SHELL32.DLL" at base 7fff17b50000 "powershell.exe" loaded module "PSAPI.DLL" at base 7fff19c30000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7fff17670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7fff17670000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff16a80000 "powershell.exe" loaded module "AMSI.DLL" at base 7fff0d490000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7fff16a80000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff0ec20000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff0d470000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\85PDRGRV.DLL" at base 7fff07df0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7fff07d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffef7b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffee2d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffef79c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffee24d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffee2160000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7fff07cf0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7fff177f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffef7870000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7fff07c80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffee2080000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffee1f40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7fff07c30000 "powershell.exe" loaded module "SECUR32.DLL" at base 7fff0ec30000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7fff168d0000 "powershell.exe" loaded module "WLDP.DLL" at base 7fff15ac0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffee1e60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff19b80000 "powershell.exe" loaded module "USERENV.DLL" at base 7fff16900000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff19f80000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7fff1a060000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffee1150000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffefde80000 "powershell.exe" loaded module "OLEAUT32" at base 7fff19d90000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffee0f10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DIASYMREADER.DLL" at base 7ffee0da0000 "powershell.exe" loaded module "GDI32.DLL" at base 7fff1999000034:T651,file/memory contains long string with (Indicator: "New-Object"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "Write-Warning"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "& $executionMethods[2] $scriptContent } } } else { Write-Error "No executable content available" }}# Initiate decryption process& $executorhandler" (Indicator: "Write-Error"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "powershell_ise.exe"; File: "99W5PMRZ83KXC3KB8PE9.temp") Found string "Write-Error "Base64 decoding error: $_"" (Indicator: "Write-Error"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "$decodedBuffer = New-Object byte[] $cipherData.Length" (Indicator: "New-Object"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "Write-Warning "Decryption process encountered errors"" (Indicator: "Write-Warning"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "Write-Error "No executable content available"" (Indicator: "Write-Error"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "Write-Error"; File: "AMSI") file/memory contains long string with (Indicator: "Write-Warning"; File: "AMSI") file/memory contains long string with (Indicator: "New-Object"; File: "AMSI")35:T771,"powershell.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}") "powershell.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "powershell.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "powershell.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "powershell.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "powershell.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "powershell.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "powershell.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "powershell.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "powershell.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "powershell.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "powershell.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "powershell.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "powershell.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")36:T467,Observed system executable string:"CFSFAppDataRoamingMICROS~1WindowsfLhGSTARTM~1ProgramsWINDOW~1WINDOW~1.LNKC:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnkdesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS/C:\WindowsSystem32WINDOW~1=K$uv1.0m=K$u.=Kgm powershell_ise.exe=Kgm=Kgm.C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe%systemroot%\system32\windowspowershell\v1.0\powershell_ise.exedesktop-fvvf82a'KPv'KPv1SPS1SPS" [Source: 99W5PMRZ83KXC3KB8PE9.temp] Observed system executable string:"%WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe" [Source: 00000000-00007692-00000C2E-2491617964] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" [Source: 00000000-00007692-00000C46-31301313445]37:T4da,"powershell.exe" reads file "C:\Users\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "powershell.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"38:Tf7e,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007692-00000C2B-953199244] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00007692-00000C2B-953566162] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00007692-00000C2B-953702792] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007692-00000C2B-953806342] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00007692-00000C2B-953944348] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00007692-00000C2B-953996610] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007692-00000C2B-954050769] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00007692-00000C2B-954110637] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00007692-00000C2B-954184136] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00007692-00000C2B-954227512] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00007692-00000C2B-954332492] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00007692-00000C2B-954506989] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00007692-00000C2B-954603251] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00007692-00000C2B-954879965] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007692-00000C2B-954883836] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00007692-00000C2B-955027836] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00007692-00000C2B-955195130] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007692-00000C2B-955282445] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007692-00000C2B-955493909] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00007692-00000C2B-955540451] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00007692-00000C2B-955620004] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007692-00000C2B-955824653] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00007692-00000C2B-955907082] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00007692-00000C2B-955978989] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00007692-00000C2B-956256233]39:T625,Spawned process "AddInProcess32.exe" (UID: 00000000-00003652) Spawned process "AddInProcess32.exe" (UID: 00000000-00000952) Spawned process "AddInProcess32.exe" (UID: 00000000-00006488) Spawned process "AddInProcess32.exe" (UID: 00000000-00007324) Spawned process "AddInProcess32.exe" (UID: 00000000-00004316) Spawned process "AddInProcess32.exe" (UID: 00000000-00003608) Spawned process "AddInProcess32.exe" (UID: 00000000-00008644) Spawned process "AddInProcess32.exe" (UID: 00000000-00004404) Spawned process "AddInProcess32.exe" (UID: 00000000-00005728) Spawned process "AddInProcess32.exe" (UID: 00000000-00008888) Spawned process "AddInProcess32.exe" (UID: 00000000-00008760) Spawned process "AddInProcess32.exe" (UID: 00000000-00002952) Spawned process "AddInProcess32.exe" (UID: 00000000-00008872) Spawned process "AddInProcess32.exe" (UID: 00000000-00008928) Spawned process "AddInProcess32.exe" (UID: 00000000-00002568) Spawned process "AddInProcess32.exe" (UID: 00000000-00006124) Spawned process "AddInProcess32.exe" (UID: 00000000-00009184) Spawned process "AddInProcess32.exe" (UID: 00000000-00007896) Spawned process "AddInProcess32.exe" (UID: 00000000-00005872) Spawned process "AddInProcess32.exe" (UID: 00000000-00005220) Spawned process "AddInProcess32.exe" (UID: 00000000-00007812) Spawned process "AddInProcess32.exe" (UID: 00000000-00005856) Spawned process "AddInProcess32.exe" (UID: 00000000-00007244) Spawned process "AddInProcess32.exe" (UID: 00000000-00006996) Spawned process "AddInProcess32.exe" (UID: 00000000-00009036)3a:T625,Spawned process "AddInProcess32.exe" (UID: 00000000-00003652) Spawned process "AddInProcess32.exe" (UID: 00000000-00000952) Spawned process "AddInProcess32.exe" (UID: 00000000-00006488) Spawned process "AddInProcess32.exe" (UID: 00000000-00007324) Spawned process "AddInProcess32.exe" (UID: 00000000-00004316) Spawned process "AddInProcess32.exe" (UID: 00000000-00003608) Spawned process "AddInProcess32.exe" (UID: 00000000-00008644) Spawned process "AddInProcess32.exe" (UID: 00000000-00004404) Spawned process "AddInProcess32.exe" (UID: 00000000-00005728) Spawned process "AddInProcess32.exe" (UID: 00000000-00008888) Spawned process "AddInProcess32.exe" (UID: 00000000-00008760) Spawned process "AddInProcess32.exe" (UID: 00000000-00002952) Spawned process "AddInProcess32.exe" (UID: 00000000-00008872) Spawned process "AddInProcess32.exe" (UID: 00000000-00008928) Spawned process "AddInProcess32.exe" (UID: 00000000-00002568) Spawned process "AddInProcess32.exe" (UID: 00000000-00006124) Spawned process "AddInProcess32.exe" (UID: 00000000-00009184) Spawned process "AddInProcess32.exe" (UID: 00000000-00007896) Spawned process "AddInProcess32.exe" (UID: 00000000-00005872) Spawned process "AddInProcess32.exe" (UID: 00000000-00005220) Spawned process "AddInProcess32.exe" (UID: 00000000-00007812) Spawned process "AddInProcess32.exe" (UID: 00000000-00005856) Spawned process "AddInProcess32.exe" (UID: 00000000-00007244) Spawned process "AddInProcess32.exe" (UID: 00000000-00006996) Spawned process "AddInProcess32.exe" (UID: 00000000-00009036)3b:Tc63,"powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001_Classes" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "powershell.exe" monitors "HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" (Filter: 268435461; Subtree: 1)3c:T659,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")3d:T964,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "POWERSHELL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2026"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")3e:T459,"powershell.exe" reads file "c:\users\%osuser%\appdata\roaming\microsoft\windows\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"3f:T4f9,"powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\99W5PMRZ83KXC3KB8PE9.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1dcae4.TMP" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\99W5PMRZ83KXC3KB8PE9.temp" "powershell.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1dcae4.TMP" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"40:Ta2a,"powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ATL.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\FLTLIB.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CRYPTSP.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\LINKINFO.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\LINKINFO.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\NTSHRUI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\ntshrui.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SSPICLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\SspiCli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\SRVCLI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\srvcli.dll" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\CSCAPI.DLL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\system32\WindowsPowerShell\v1.0\cscapi.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ucrtbase_clr0400.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ole32.dll"41:T99a,"powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\99W5PMRZ83KXC3KB8PE9.TEMP" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\99W5PMRZ83KXC3KB8PE9.temp" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.DATA.DLL.CONFIG" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.TRANSACTIONS.DLL.CONFIG" "powershell.exe" trying to access non-existent file "Z:\" "powershell.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\MICROSOFT.POWERSHELL_PROFILE.PS1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSD1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psd1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.PSM1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.psm1" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.CDXML" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml" "powershell.exe" trying to access non-existent file "C:\Program Files\WindowsPowerShell\Modules\MODULES.XAML"42:T8d6,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\windowspowershell\v1.0\powershell_ise.exe (UID: 00000000-00007692) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00007692) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00007692) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00007692) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00007692) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00007692) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\* (UID: 00000000-00007692) "powershell.exe" called "FindNextFileW" with parameter 0d59b0e237d7519417de10cd84bda4e7 (UID: 00000000-00007692)43:Tb8b,file/memory contains long string with (Indicator: "aes"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "3des"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "FromBase64String"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "D3wjZfaiElJvYUUaesv0zW7bWvNX5FHp1ebNyN3t40csfi9csoN6VW9pYGtJxtvK" (Indicator: "aes"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "WvpT2VT5edf07dDIn+7AeSB+L1yisXpRbmd2e2XY4NJ68W7oVvpW8pbCyZfF4s5l" (Indicator: "aes"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "EnkSZfSkEhYbdRFsW9DbhQ31fvRH93j53e2X4dDElFcAeSlthqlIbGlnWFVR3vn3" (Indicator: "aes"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "UO16/AzrVYTDweSe8MHlBDl3AESnumN7DXRMbFva9dpa9370BfhX+ezt49Pj5fVM" (Indicator: "aes"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "dvd55wv8a9zO8cnf6O3deSh6On2rrGpgWEFFVUfB8PRU8ETsDv5R05PE7+ne4M55" (Indicator: "3des"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "Um1YYrykZkVLanF7WNv16H73edVK2Vrx7Ojl7szu83kAeSpbrqxqYFhwY1UJ1Njs" (Indicator: "aes"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "# Layer 2: Base64 Reconstruction" (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "$base64parser = {" (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "return [Convert]::FromBase64String($recombined)" (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "return [Convert]::FromBase64String($recombined)" (Indicator: "FromBase64String"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "Write-Error "Base64 decoding error: $_"" (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "$binaryData = & $base64parser $cryptedblock" (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") Found string "$binaryKey = & $base64parser $xorkeyrotor" (Indicator: "base64"; File: "deb95b23dbb48839642ed2270a28b4af9a16ff54fbb3993a8e541b7c51e327e8.bin") file/memory contains long string with (Indicator: "base64"; File: "AMSI") file/memory contains long string with (Indicator: "FromBase64String"; File: "AMSI") file/memory contains long string with (Indicator: "aes"; File: "AMSI")44:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")45:T5873,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PEL! @ `K@t`E H.text `.sdata @.rsrct@@@.reloc`@BHEcR+ (cxG&-(*0}+ (kb&- 8Y( ( }~ ~ ~ ~ o29 (Xs z <( 4X( ( 95~{o9 4(Xs z80~{o9 p(Xs z) ~{ X( o(9 (Xs z 95~ { ( o-9 (Xs zPX( TX( ~{ ( 0@o~ ( 9 ((Xs z~{ o#9 ^(Xs z X X( 8 X( X( X( 9^i( ~{ ( X( io# 9 (Xs z (X X!!:O( ( ~{ X( o#""9 (Xs z(X( ,( X##95~{o$$9 (Xs z80~{o %%9 *(Xs z~{o&&9 r(Xs z[&{''9"{( o &((9X )):*A46N=!JR+ (T)X&-(*r+ ((a&-((" *0M+ (p^&-~# 9"rp( o# s$ #~#8*0+ (d;&-~$ 8*Z+ (&F&-$*R+ (Fh&-(*0+ (T;Q&-~% 8*n+ (>Va&-((% *+ (n0&-((sA(& t%*R+ ('B+U&-(*R+ (&Q&-(*R+ ((5X&-(*R+ (eY4&-(*R+ (i&Z&-(*R+ (0[&-(*R+ (}{>&-(*R+ (@:!g&-(*R+ (4R&-(*R+ (J~OV&-(*0w+ (oB&-(( (X (X(+t (X (X(+t (X (X(+t (X &(X(+t (X T(X(+t (X x(X(+t (X (X(+t (X (X(+t (X (X( +t (X (X( +t *0B+ (fMK&-(( (X(7 (X(7*0+ ("Y=&-o (X( 9 ~ 82o (X( 9 ~ 8 (7 (8( (! 8*0t+ (-bd&-~& Xo' o( 8: ~&o) Xo* t2(+ to, X i?*j+ (5yu/&-((" *+ (yo:&-((( o# o- &*R+ (&J&-(*0 + (*9\&-(2( o# '@)%L(. ()A<635~ *~ @ 4+9;s/ ?>j7:8j -=./~ 0Bs0 1(1 &*>+ (wi&-*0 + (G0=&-) iZ ]Y X ] : ij \nXjXmijjZ8Xi?i%q `ҁ8$njYYZ?_d j_ҜY=iZ \ #Eg ܺ vT2 8K b8>dXXbXXb`XXb`X`X=D (N (N (N (N (N (N (N (N (N (N (N (N (N (N (N (N (O (O (O (O (O (O (O (O (O (O (O (O (O (O (O (O !(P "(P #(P $(P %(P &(P '(P ((P )(P *(P +(P ,(P -(P .(P /(P 0(P 1(Q 2(Q 3(Q 4(Q 5(Q 6(Q 7(Q 8(Q 9(Q :(Q ;(Q <(Q =(Q >(Q ?(Q @(Q X X XX X \D (2 (3 (2 (3 (2 (3 (2 (3 *+ (+C&-K_f_`XX~(YX(RXT*+ ({4&-K_f_`XX~(YX(RXT*+ (ma{n&-KaaXX~(YX(RXT*+ (?pl&-Kf`aXX~(YX(RXT*~+ (fHJ&- Y_d_b`*+ (UT&-~):(U)~A*0R+ (VP-Y&- (S9s4 8+s5 &r?prp(6 o7 t< *%0 0$+ (og&-(8 A&*+ (?6&-(S:s9 (: *(M*f+ (EiY&-rJpo; *08 + (Pz1&- 58% /Y 78%@ 8% J (Y e8% N8% G58K5:.8U%~3 8@% oX n8'% 8% AY E8$ c DX 8$ 8$> 8$ 4Y 48$X _dҜ 8w$ dX 58X$ ?8G$ [ PX 8($ LY 5:$ 5 X B8# 7Y @58# EY I58# NY 8# @Y e8#*)8h3 8b# X v58I#!X! 85# 8Y C58# PY A8# + Y &8" 8" LY _8" ` DX X59" 58m" z8Q" Z OX ?5:7" U &X 8""~'r~p8282/ m8! X8! /Y Y8! SY z8! W8!X 5819z8x! /Y 58U! 89! 8)! J58'198 K YX 8 : HX 5: ). 8 1 ^X 15809 ;59q ?X 58N LY 58c09, +Y A8 S "X 58 0: DY 8 N828/ 5: B8 ^ `X 8i 58Q)8/ i8< 9Y _58#). 58 /Y 858 X o58 CX C58 O8 _Ҝ 58.9| QY 5:X f @X 85 8 8 $)i?& 58T.: IY 58 Y 1X h8~'8.8.. %8 MY {59v =X 8[.i> 8G 8/ "8X .8 8 X 58 7 cX +8 8 [58,:8p J X 8U =Y 8. ? X 259 9Y (5: qX 8 v8 H 8 \58 =5:g & X )8J 82 4Y 8 u59 ` DX 5: + CX 8%Xb%Xb`%Xb`%` >58 8t x8db 59K 4Y 8( 359 PY ~8 b8 BY f8 5Y 8 ?X 5: 8z$ 58#:` ( Y 8C NY o58t#9% l8 58E#9). :80 8 Z X |58 Z8i(XY` 8#X# 5:h%Xb%Xb`%Xb`%` G8/(? r58 8 `8 59 P58X _dҜ k8 TY 8X _dҜ M8j 98Ja 89 d5: ) . 58 Z% 58 > .X 8 f5: 7Y 8 Q8 r8l M8T*8 u8B '82 = 58\:I8 X 59 {5: 1Y 59s SY 8P 5893 h ]Y ~5898 TX p59 t TX 5: g X 8 f Y 58 NY t8s0X0 58:8Q # X i593'83 8 5Y 8 58: $ X 59 l58_98 2Y 8~ SY #8e0X_#_dҜ -8?/8 8. ,8& 58: F JX ;8 # QX 8 8 58 8 CY 8k @ sX 58L EY c87 58 ] X 58 / 8| 8n j8N !5:5 5898 6 \X p8 > :Y 358 yX a59 X J8 } )Y E58~ GX 58E9?8Q8(> U86 C GX 8 w8 +Y $589 iX 8 8 89& 8 8r 58R +Y ^585 .Y 8 8 IX 59 AX S8 58 v `X K589% y8b 589 ` ). 8080> K8 c >X 5: 8 A pX :8 SY ^8 ` .Y 8 Y T8k 8[ 9Y R8:i 8- CY n8 G xX Y58 $ vX 8 & bX 5: 5 %Y 58 CY 8v T DY 58] LY /8B( 58I9( OY 858 [ ZY 8 XX 8 8 Y'F" h: >g3 | E? _ZdY U" _Z"dY" !3ZX33Znj`Zn^m3d3b`"a _- _d-b`3"Xdb`"a _ _db`da3XbaXdaXbXaXvlmX 58 ?Y 28% 8# 58: R8 8t T58\~3i: 8J >Y *5:" @ RX H5: 8 8!Y@} %8 m Y 8 Y V8 QX 8q F kX 58:S P IX [595 x &X D8 8 55E;!FMS8w22t1/(J)p1.$uTNa!9C\+CJuAX5Ve[mtqX:QTq6ZO: p&S<$#9~qa,2)\!'uM *FrbGwfjDU`=MXIrsY5UfyCRnLb< X 48y2i8 589o8W 6 Y U8: 8*). 58:S8 X D58: 8 e X 8 P8 8& 58l I \X 68W C .X @586 -8" c5898 " IX (8 @ wX Z8 w WX *8 v !X +8xi[! 8f.9 5898K JY g8. S RX !8 598' 5: LY #8 HY O5: 8 ^X "5:m JY 8R X 581Z 58:8 8 : YX s8) \58 tX 589 g mX ]8 / cX 59i 9Y 59E 58) )59 V59 58:38'82 58 EY 8 S8 ! (X F58T:a8~3X,8888(}8(|8 &rp* *(8(v8(k8s< 8(~8`(~8(8;(8(~8(z8(q8\(8(~8(r8(s8(8(8,(~8(l8(m8({8(~8R(8(8(~8"(~8(8h(8(l83(n8.(o8*(x8(t81(~8(~8Q(8(8(u8H(~8(z82(~8N(8(8.(~8L(8(y8(~8\(~8(p8(~8(~8(~8(8(~8b(8B(8^(8(~8#(~8n(~8z(8(8(8G(~8p(~8(8+(w8(~8(8S(~8v(~8L(~8s= 8C(8(8u(8>s> 8H(~8*5>500 + (X[<&-rpo? &(@ (A ioB *B+ (I^2&-*0 + ( /&-(1 &*0e+ (>8&- ( rp ( ( (C oD t**0+ ((e&-t.oE (F 9t.oE &t.oG oH oI r ioU oV oW *0+ (Թ\/&-*0+ (lE`h&-*0B+ ("\U&-r`p o; >**0B+ (`U=&-rp o; >**0B+ (B9&-rp o; >**0B+ (S&-rp o; >**0B+ (VD&-r0p o; >**0B+ (kZ&-rdp o; >**0+ (F7:&-*0+ (M `&-*V+ (79&-(" *r+ (]5&- oX *b+ (O&- oY *r+ ('\&- oZ *b+ (}kX&- oO *r+ (/&]m&- o[ *b+ (8&- o\ *f+ (\-O&- (] *b+ (\WH&- oG *b+ (T&- o^ *V+ (FC&-(T*r+ (F&- o_ *+ (xR&- o` *+ (d/Q&- oU *b+ (k/_&- oa *b+ (g\&- oW *b+ (-W&- oV *v+ (;Tj&- ( *V+ (f 3&-(A *+ (&g.&- oB *B+ (';&-*B+ (:wX&-*j+ (m ,B&-((b *R+ (kP&-(*j+ (EH&-((" *R+ (m@d&-(*0+ (b~T&-(A oc %Q(. (A oc (V s= (ToR oS od s> ioU oV oW (e *j+ (n&-((" *R+ (0&-(*R+ (-3gG&-(*R+ (e_>&-(*>+ (]<&-*V+ (b&V&-(" *R+ (/[Y&-(*0I6+ (b@&- 8 SY T8 QY q08? 8 208E3:8 AX Z0:a { X 08D rX 8' 08~I:2 8 8 yX 609 8 08X2:8 @0:k s X y0829C *X 8( %09 h08#X _dҜ e8 =Y A8i+XY` 8 ? ]X 0:q #08/1:P s X 85 K X I8 8 ` 2X B0809 8 n8 BY >8,>n 08y 8e$,? O08J GX 85 q X 09 X dX r8$X$ 08/:<8 ~ Y 8 98 )08+ ?# }8l- 8\Y@ G8O 8 (X ^08 /9$8 JY B8 08.948 P EY +8 o X 08.9 :Y 08u 8Y C8I o X 0:' s X Y08 8 ;8 8 b 08 y8 -Y t0:r -Y g08U >Y *082 -Xb-Xb`-Xb`-` ~8 .Y b8$ 8 ,Y 0: X `X 8 08~ EX 09`i[ 08`,98@ N8$ 6 X 08%,: .Y u8 1Y [08 EY 8 JX 88J 09z H GY h8W 6Y 18F 4Y 8' ;Y 8 08 8 5Y 09 3 7X 8 # _Ҝ l8 g fX =8d c8L 4Y 8- {8 5 tX 0: i ?X 8 n IY 8 8 % 78 R #X 8 ,>~ 08)9i jX A8T \0:3 8* \ uX 8 *8 X /8 R8 lY -08 qY "8 G X |08(9` 0 IX 8E . BX 08\(9 8 ;Y 8 - X {8 z 'X q8 fX 881$> t08':w ]0:Z v |X ,09< X 8 BY x8 308:':8 8 8 m8 :Y8&8&:&%& 08&9|8_ 4Y :8B ]X `8# TY a8 3Y L8 :Y 8 508.&9Z 8 ;Y 09 E08e 08I ' X D08,X c08 :Y 08%98}%8%H (8 T Y 48 u08 909 o -X 8` HX 8I JY ,09' ,X 08 X 08#$X_*_dҜ 09*X* 8 BY `8 q aX l8 B uX X8hi], 08V ` FX p08#:z 8/ IY d08#: DY K08#98 gX 8 RY j8 "X 8 x 0X a8n :Y U09L E OX 81 _X T8 u IX 8 /Y <08 8Y K8 09 8 n |X <8a 8Q X 88 3Y H08b g08!9&8 FX 8 X b08 ^X 08 6 X 8q L JX 08X - ZX U09: S 8X .08 Y8I 00EFVQ_A s3K#2- $^1K R%~P*k%`'Y`=t {]F' tOe[Z[. &f Vj\2>h4a rm7=^ > uwAc HM WOn0n8%'$|l ' N 88 t IC7^e+Sx"z3FdqZ0v 8 8 z0:|&& Y'F h: >g! | E? _ZdY U _ZdY !ZXZn j` Zn ^mdb`a _) _d)b`Xdb`a _ _ d b`!!da!!X!!!ba!!X!!!da!!X!bXa!X!!vlmX& J08|: ! GX J8X M8'Z w8i +08%9N8G 1 +X =82 r IX 8 P8 IY [08988 N(X88 N8 C08:8z 70:] m JY O8B Z 7X R08 8 lX 8 9Y !8 ?Y 08 8 LY D8 08{9\ &08d9; 58 8 8 8-i[. 8 18 Y /0: s089} * X #0:_ ]Y v8B O bX 81 % X 8 -X I888.]' 8 X 8 X 8 ' |X ?8 JY 8y 8a 8I 89 08 x TX $8 8Y 8 f88j8 H0: 8 o8x 5Y 8a 3Y 0:? 8+ U JX "0:8@ a L0:+X+ V08 / BX 09 \08 & X 8qXbXb`Xb`` 0:; / &X @8 m eY 8 i8 c DX 8 Y M09 6Y }8 /Y 08:n8n RY k8S CY 82 (09 8 : FX 8 X dX 8 # X m8 8+ 8 QY >08:z ;Y k8e @Y 08> 8* FY 8 OY 8 9Y &0: 8X 8# 0898 8w 8W ;8?& 0:0 y X _8 < rX 08^9 08 7Y 8 8 ^ _X %8 O X ~08li# 08S #X s80 | $X 08 08 88 Y ^08 9Y 8 68 K Y E8j 1Y x8K " X 08, Z 7X V08} 98 y ?X 8 8 C *X -08# 9 p88+> 08m cY 8R @ -X Y81 o8! Y 09 X09 a Y 88 8 l >X 48 9Y '8zI 0:i 8M /Y 8< BY 0898 FX 08z9 8 OX 8 CY 088U--aҜ 08e U eX 09G 08+ 8 8#X _dҜ 08 :A8 8Y F08X .8 ?0: 08u CY 8Z hX 8A Z8)~Ht.8 G 09 F vX i0:#X _dҜ n8 :Y 0: PY 8 r X 08m uY 8J S ]X 08+ 7X |8 I X 8 d BX Q8 I WX F8 8 X 08B9 * X '0:i j08M @Y $08:8& ]08 ,>u 08: /Y W08: P zX 08: 8 6Y 08p BY Q08/:H S0:+ BY 8 \ [Y w0: 8 8 08 ! GX 8 >Y )08X:8b r8F 86& v0898 8 8 I 4Y W09 X 8 6Y 08:8|Y@s _8k P8K DX G84 f08 8 209 8 8 8 8* 0:x o 1Y :08e:V ]Y e08M:)8/i? 8 ^ &X 888i8% 0: !8 8 8 IX d09 +Y 09^a8t& 8K ~ *Y 08* IY 08 08 @Y S08 [X 38 08 0:z cY 08] 8I*(8(8(8(8(85(8((8(8(8M(8(8(8^(8](8(82(8(8(8(8(8(8w(8y(8t(8(8>(8\(89(8z(8(8D(8Io# 8D(8Is< 8D(8b(8{(8(8F(8(8(82(8!(8(8(8y(8(8Y(8|(8u(8:(8(8(8>(8V(8n(8(8(8(8p(8(8(8(8(8*0l+ (FJ&- ( o# (f 9=~I:(sg oh oi ~Ht.oh oi oj *oh *0[+ (z9H&-~I:(ok 8!~G( 9~Ht.*X~Gi?*+ (1&-(" (l sm on *+ (~;\U&-~J:Js&*+ (}P&- GHIJ*f+ (Zth&- ( *r+ (_=&- oX *b+ (&1&- oY *r+ (w}8&- oZ *b+ (}m .&- oO *r+ (']&- o[ *f+ (a/&- (*f+ (ܕDm&- (*b+ (46&- oh *B+ (G>X&-*B+ (]8&-*0+ (N@I&- ~o 9K 8oYEP@'8NGXGb`XGb`XGb` 8,GXGb`XGb` 8GXGb` 8G *0+ (a&-~o 9$YE*T*R* YEI;#*RXdRXdRXdR*RXdRXdR*RXdR*R*05+ (P&- 8XGXG X9D*0M+ (S_&-(p oc % 9 i:8 i(*0&+ (>"n&- 8 XRX D*0)+ (."W7&- 8XXGRX D*0I+ (wP&-(p oc %9i:8i(*0+ (H5&-~o 9-AKT*X 8KTXXD*CXA (*X8GRXXD*0X+ (Qc XAS8+ Y((#XX X YD Y(X(@}(X8X(@ XYD _bY[jbm``(Xd `8(da _njZXMnjZX~o 9?Y[j j=$Y[jj>KKa _88TY[j j=>Y[jj>/GG@$XGXG@XGXG89Y[jm~o 9KK8XGXG9?B'bRXd `X8V ?B1b`(Xd `X8GRXXd8d `8XXGXG@ DXB1 B%Ybb``(X8"B1 B%Ybb``(X8HD@Ybb``(X8GRXXd YD8H_@$d `(X GRXXdC8d_@d `(X X(Y[jjYjXm X( X(XY (X( (**0+ (,5&-%9 i: 8 %9 i:8 X XX(X)%R(. Y (X(:X(;X(XY (X(:ݟX(;+ XX((X(a D9X8GRXXDY[jm@(X(_@cd_:, _dY(XX8_:, _dY(XX8c_:8 _dd_X Y ( XX8"_:8 _dd_X Y ( XX8_:6dd _X Y ( XX8dd _ ( XX8p( _X _X __d D/80@X GRXXdDY[jm*0A+ (3a`&- (q oO ԍ ioP &oV *80 + (3JO&-( (*0 + (ɡte&-( (*z+ (%KR&-i(r (*Z+ (HG&-(*0O+ (]9]&-.( (X ( (C oD *0J + (.[&- X ( 8 X D*01!+ (=U&-( 9(&*j+ (QD 6&-((" *R+ (`T&-(*BSJBv4.0.30319#~ #Strings,8#GUlD-8#US;#Blop; #GUID; #BlobW= c*Sx+! j+Z_f_l_t+_4Mf-+___ _P____ _$_6J_d____ __ _, __HXs $AKl _N X X 1+P_c|_|-|R|b_{|||6|GT^Tk|xT|_$T8wTTTT_|___ 4Li+ _xUUYY YYY'Y:Y"MY'`Y,sY1U6U7] ;];U#;a%@1U&C`sU&CY'FU'KeCUCUCYCYC *]C=iEUhUF{UGiKULUL]T*]TG]Td]T]T]T]T6^ 6h 6r 6| 6 6 6 6 6 6 1 U1 U[ Ue Uo y U U*U4U>i`|U " - 8 UC k v U&%>oIT_1LEQYVm[`[ejP h (%T5 & T 5&T5&T 5$&%T%')5-&.T.055<'=T=?D5K'MTMOT5 [0'^T^7`=b5fH'gTgIi[s5s`'x' (L) @%T7`%#%A%M%&d<&T7X&)+d*T7*T5** 7 2>3>D3>|3>3L3R4Vp444u4 znHn_\nnoHppLqhq#q.q9$rDtrOrZsedsps{sT7ssst tLt%ht8tStftttu@u\uxu!u4uGuZumRvRvT8vPvT7lvv wT7T7%.?FF%.?FF%.?FF%.?FF%.?R`lqR`lq%.?R`R`%.?R`R`%.?R`R`%.? " . ? K " . ? K %.? K ? 9%.? %.?%.? T)T71TDATYQTYYTYaTYiTYqTYyTYT|TYTYTYT7H>OEU TYqXy_TYchn!u117I5 I= T73aT9T7ynVbwQq@T7T78)uT7T7lbj RT7nI!1T)T79TIQYYqa)!q0&iERI[ c2k7qyTJA!XA\7rrxA~A 7)q1A11 7)Kiy97T7Y.xQ4qT7qT'.Y^aQTT7T7TTP T7).[^.S^.Kd.c.{.s.k.;.#J...;^.CJ.+^.3^IG G G G G #G CG cG G G CCoCcccG G cAW W W W W W W ::$(%& '(@)*)Gi\>ds/;Nbu5FTZw<>=@ )@o @q L!M(!NF!Of!Pv!Q!R!SE K _ F K ! " $#%#&#'#(#)#*#2u ttttttttttALTERNATECompilationRelaxationsAttributeSystem.Runtime.CompilerServicesmscorlib.ctorVoidSystemInt32BooleanRuntimeCompatibilityAttributeDebuggableAttributeSystem.DiagnosticsDebuggingModesAssemblyTitleAttributeSystem.ReflectionStringAssemblyDescriptionAttributeAssemblyConfigurationAttributeAssemblyCompanyAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyTrademarkAttributeComVisibleAttributeSystem.Runtime.InteropServicesGuidAttributeAssemblyFileVersionAttributeTargetFrameworkAttributeSystem.Runtime.VersioningSuppressIldasmAttributea82a658d-5dfc-4890-8b24-6ed5aa5f92d6ALTERNATE.dllvMfVLlNnYnkA1kRtkbuT0F35ZPOk9FmjB9MTObjectEXECUTEic9FjVumN5072PnI9LMulticastDelegatedboGRfrQNqbcGNO6CqUDeyG78482AFR1FptFAri4mg0nloiV2qPKQUFjtNm6KZ2RbwHucgvpSFFAsoTRvcgiU9NKRMi61qsWYt80s2cijrg3nXXXD45fAQriODui4MJXP53doXEh1YKXLe9cEcJPTG72V6sss8MkAOvF0RZknXNLawDCIQovTTi0FjWN1JvfejROoYnOylQ03U3teI6H2vTaValueTypeIy66GPkyiuVqUrTnNDResourcesALTERNATE.PropertiesSettingsApplicationSettingsBaseSystem.Configuration{F2F1F72D-19B2-48B8-9442-008E69A102A1}ij4QLwFnYAQktBHOCWr5YS3vqmXUmCRRAATAaBCr8ApDIQK3gpIejuv59NgIb7Eul9u2iPdQykTZeJ49mQMGvdkDAJonWCnOvHb82gNNEqdVAttributepaJ3vsCFAffxfLRPYU`1gtHSUhAB0aIrG8iwG0HqhlB8Gorm05rbPgZNw4OFLe22GYkotaniqIQBYDxOtLKD27o8QOBwKKZgTTLYBHjt0EM8HDEnumLWRKLJIyxgbTaGDkBLoxqa5F6hV09Rv1BvihO5MBTqESsN1LV3u6Q1cIMl8sRLjd4qg6HCpeT3fUy4D4CxX8HgoT03F0T1KUPPUjS8f9GtR5{6D170BEF-14EB-45D0-BFB1-2B06D07184C2}__StaticArrayInitTypeSize=256__StaticArrayInitTypeSize=40__StaticArrayInitTypeSize=30__StaticArrayInitTypeSize=32__StaticArrayInitTypeSize=16__StaticArrayInitTypeSize=64__StaticArrayInitTypeSize=18.cctorLAUNCHtargetPathByteshellcodeIntPtrInt16TypeGetTypeFromHandleRuntimeTypeHandleMarshalSizeOfZeroInvalidOperationExceptionBitConverterToInt32get_SizeExceptionop_Explicitop_EqualityToInt16BufferBlockCopyArrayGetBytesProcessGetProcessByIdKill InvokethreadHandleBeginInvokeIAsyncResultAsyncCallbackcallbackobjectEndInvokeresultcontextDataprocessHandlebaseAddresssizeallocationTypeprotectdatadataSizebytesWrittenbufferbufferSizebytesReadapplicationNamecommandLineprocessAttributesthreadAttributesinheritHandlesUInt32creationFlagsenvironmentcurrentDirectorystartupInfoprocessInformationRQNTqbcGNP6CYqcDeyx74582AFRCFpotFIrismg7nloiVxqPnKQUPjyNm36Z2RbKHukcgvpQpFAWsoRvcLiUa9NKRMzejwuh59NKI7gEul9uGXUHmCRRALoadLibraryAkernel32wTAyJBCr8GetProcAddresswDISQK3gpCm1Xj0aelkoe5wXZDKDelegateToLowerGetDelegateForFunctionPointeri61FqsWt8fs2qcijrgmkXpXXD4fvQrbiODuisMy4XP53dWEhv1YKXLV9cCRcJPTw2Vh6sss8XkAAOhF0RckXGNLawDuIQ2ovkOyNQ0tU3teIAH2LvTayyB6GIPyiuVqUr6TnNDigi01FjN1JtfeUjROoYUInt16Cm1EXj0elmoeR5wXZDgYjD4QLwnhAQPktBHOuWpm5YS3vHN50072PnResourceManagerSystem.ResourcesA9LKrboGRCultureInfoSystem.GlobalizationvMfNVLlnYget_AssemblyAssemblyrCTu0F35PPk9rFmjB9lkAZ1kRtkXTY8c9FjVdefaultInstanceget_DefaultSettingsBaseSynchronizedDefaultyiPjdQtkTModuleh8xwGNsse0AmatypemdtFieldInfoMethodInfoResolveTypeGetFieldsMemberInfoget_MetadataTokenResolveMethodMethodBaseCreateDelegateSetValueget_ManifestModuleoHCpNkei3fUI44NWCxX8HLoTNa03D0TAe3Nv8E2wfLkXNACCg8ryGjNUhnxt7Int64An7NEPHwWGNAtNDToZuto5HNPw0gLZvRJNmTHAJvIfUNyvygclHashtableSystem.CollectionsYLjN3d4qg6zbuNbvfDjVglUNht9QvKwwPN4ZOOCiUFLNp52BI6p0uNIKq0bNGt3N1A67QswamNGJGGeXDuAN68Fjeif0gN2F12tgQ9GNqtR5WgxyINR0GsCDq5xNLn1AxfzWtNtOBqRWSortedListQIMNCnywYgBKUNFPUjS8VwtNHWokQbRuntimeHelpersInitializeArrayRuntimeFieldHandleRSACryptoServiceProviderSystem.Security.Cryptographyset_UseMachineKeyStoreNFLwGNs9YbV6ubeJ99mQMGUInt64CopyudklDAJWnoCnxOHb82LNNOEqdVFoJ3BvsFAfRxffLRPYUGIMd84GXHdlnQk54sQSymmetricAlgorithmAesCryptoServiceProviderSystem.CoreRijndaelManagedActivatorCreateInstanceObjectHandleSystem.Runtime.RemotingUnwrappKtiHSUhBCryptoConfigget_AllowOnlyFipsAlgorithmsfaIcrG8iwMD5CryptoServiceProviderHashAlgorithmComputeHashjrmX05rbPget_LengthLZNVG4OFLICryptoTransformMemoryStreamSystem.IOBinaryReaderCryptoStreamStreamCryptoStreamModeV2GMYkotaTrimConvertFromBase64StringEncodingSystem.Textget_UnicodeGetStringliqsIBBYDOOLzKD27oeQONJBwwKZGetMethodLTTNNYBHjtget_LocationFileExistsGetNameAssemblyNameget_CodeBaseToStringReplaceGetTypeGetPropertyPropertyInfoGetValuefEMNZ8HDgWFileStreamFileModeFileAccessFileShareReadIDisposableDisposeEKLNuJyxgbset_Keyset_IVCreateDecryptorWriteCloseToArrayhaGNrDkBLaOqaN85FhV0MRvN01Bvihga0NKp8Qu4HMVNTChZ5BKALNYOLAAUcS5N5cZ3H7olxNo5MBTqJsNN71LV3uBQ1NnuIMl8X7USij6aMx43HUBJiPGetManifestResourceStreamWBWoibSMahpiSIPfG7get_BaseStreamaMnbLxsOxFo7q5IqRrset_PositionFVT8ECl1hvGot5S2cexP6vwNOrVZSpi2THYeReadBytesYPRg27TMteLgU1dCZ5RSDrYyoG11Wqongwx1Reversert2iXVnrGFfY5ePaf2hGgciDitSOTPc8okT2GetPublicKeyTokenN7LjdAbsQOEMG9xv9xPNmGrm205R2eyFdYQVCipherModeset_ModetPQmLykAdbpCpokWeHTKObx3g0mDhiEAm9wlrfgeqXpgrCrJc8HVnvFlushFinalBlockp7Xu5ryPTwweo54REksGXqBeYRPMcs3tO9XPHqeeBOJsi4k1XSN8XhCm3uumNbvhC81ISqrkL87w0QqyyjbJYyfJbAW3taLjVx6E69bmybqMfs6aqNC4YJEZ7f3w7YGIM84GhXHulnk54sQFKL0NSs9nx0CreateEncryptorToBase64StringclassthiscompinfoflagsnativeEntrynativeSizeOfCodeikvNwMnwnvyrKNgRCiH4value__HCyNjqm317SotwGNsz5qkiWxIKNBQyisCqgHNfc6iUUR7mNdQ44KZOP4NQHumPds1KNlmGsFFKtVNxXItedList`1System.Collections.GenericGetManifestResourceNamesAddRangeIEnumerable`1HfdNOQ745YResolveEventArgsget_NameAppDomainget_CurrentDomainResolveEventHandleradd_ResourceResolvekLjw4iIsCLsZtxc4lksN0je1I9MH97L5AW9ZNdnGUKKQTo3MnlZojqgoDJh507kEw1UyAIXD8vkiXx0Kv3xlboTKhyYHeCdK9d7yTRsLAXKiN4sGS4pbP9yahIrxucytNpQZXM4EkxdcqWXAjPwfV6WomFsIQa44XFOfVAWJsKHteRYmESH2fvi1tL2rpkQBmi5mQ3oeArjLJUV7GkRkknruWdwimj7NiyqfilIsLittleEndianzwVNc37vcjGA8NeCf44GJxwNXHAur4get_ASCIItZaNV9nvdqVCuNMs04I2QQMNsALfZIzMZNzV9ffaumpZJBqCu1toZZNFjnA9G2CZZ1pfZ2IhMZudA1jWcMmZrmyLJdbV0Z80rrhsOpenXQ0Z0HNaHYQINZK0s4b1VLxZT7Dox8ToUInt32UTYZYeZPeAyF1Z5AiAmkgaBZoCHc7KXEvZ7HYNTn$$method0x6000007-1$$method0x6000020-1$$method0x6000020-2$$method0x600002a-1$$method0x600002a-2$$method0x6000039-1$$method0x600005f-1$$method0x600027b-1i3lCvK8fIyEJDekxk1.0MGq4sJ36LxLN7iy0iADux7KUE4rKG0I8ukT.7OkSWQAIAYtNpQ1UGtGeneratedCodeAttributeSystem.CodeDom.CompilerDebuggerNonUserCodeAttributeCompilerGeneratedAttributeEditorBrowsableAttributeSystem.ComponentModelEditorBrowsableStateUnmanagedFunctionPointerAttributeCallingConventionFlagsAttribute=ALTERNATE.Properties.ResourcesSystem.Core Version=3.5.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089kSystem.Security.Cryptography.AesCryptoServiceProvider3{11111-22222-10009-11112}KADux7KUE4rKG0I8ukT.7OkSWQAIAYtNpQ1UGt3{11111-22222-50001-00000};GetDelegateForFunctionPointerfile:///Location3{11111-22222-20001-00001}3{11111-22222-20001-00002}3{11111-22222-30001-00001}3{11111-22222-30001-00002}3{11111-22222-40001-00001}3{11111-22222-40001-00002}ZGRN&gz\V4 TWrapNonExceptionThrows ALTERNATE Copyright © 2026 )$ecddf8e4-e995-4440-bc07-1eda7d49b6de1.0.0.0M.NETFramework Version=v4.5.1TFrameworkDisplayName.NET Framework 4.5.11*D@y}y D@ D@ D@ $(,04 $ ( , 0 4 y LLLLy y y l M6 ! !%- y y 5 y 9= AEI ! ! Q Q A1 U U Y ]a e E E E 1EE !EE ==AEI @3System.Resources.Tools.StronglyTypedResourceBuilder4.0.0.0 y&9W@mɳ?3Țjjp$YKMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator11.0.0.0 PykTZeJ49mQMGvdkDAJ.v59NgIb7Eul9u2iPdQ+onWCnOvHb82gNNEqdV+paJ3vsCFAffxfLRPYU`1[[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][]()k\{|sDry~/PavJK4RV)o8#+ǩ ̕ Èb=>ORMGMDqT{ܛx( "Te_r? 6 CX?W2.jckvZ㘃si$?d* qiCvCZŁ;~6͐뭖c"r_;K:1ςIUjcKH?˝SoB IE\}S?[^!dR+ϹpDK{ru"6+ėiM(u?;/EΝu"+zy`6}KXQyO?;R>̴C@:l^tCXu65#)ie0iVɦ<$1IOZ1sg; {h5E.oH`${MYWR{F>-@jb\PN]vgJļ܍M3i&?agÏT^{CbnնA#v?Iyq6=MeZH|ՓEh$tUBDCѓ*J®pYbK5S2_jW3)8:H3n4 LvNJfTWڳV3K \Z7ʷ*5`UZYk6muQ(8tG~㎻QoIБᳬ[]$ ":40\b_E6( n;mr~`ᾝފB]HþR%q|hJ ݺ$3n sp w~e}/pݶNmJF=U|X1T6z.eWSwrGLd`&KWjIa.*ڙQv?$IB\ÆiW=0vG9УΌwUɏ,7\23RRއcczeմ.H]?j7 Gc.^m6RϣZ(u$tۭҞe; G%6HwO6U؁4#aiiwT,F^du(t]ȟ;&Qfzx+&)k=Q?̸L"sCֈ,ڙx=2ώ,MP^ALwESbY̦A%bfYC2A;t}dѦifKBmPts35Z[&@%F"ȇnl!Y8ߋYy62Q#Z{vqGА lg ڀ V{)?(Vɷ9=cݳdCzj&iO\)P9GRxD0;rq}qr7 aY:c^0#I֕HrTÄGrb'"C4Nn Pzfw=RϷTHR: ['-8cf! $|! h[/HnE'P|gcɞzW9OkM@̙st\s t[*Vj;I8*Y?)ʄm:r(z9 ))rmi=ϰidt']F&seL9;-JulvYpoW6%bsN*al[uuEe{拚^ ? 0oXF[ĆL}wrrx}&iJ>W&uߍc8*Xd18\Qө[ Q}OԿK n l]ZCHu_=G~-l ΁B@9BN7VO&8٣Wĥmx ӷ+DΓF (j> f!t%Fu=y64Mm»E :F͛@ 6;#:.h ?ZQ湖@5KvDSj+3=s2ֿy5k%i7VS\E]V@g0k+tEjÇSUoO^L`U3"$aZ>&s/$`T}2DEq ܸ ?Ĵ_"W5b2##ϬVD]ɿC>Fd $*~5g>tKV3B.te(I`V(e1?Kc8:..b`KdG1l P5>Ts/Ұ`SOD(0rA'|(@^;񜣓&em"B@a%?qֵ7mnJe=燓6\LZ]٢z(TхwQ!rmZ>dn/WA mFqw/)Մ\\u*0 w=h/QWXG>|`!ڶVlB߷)"hK];O{)RVGpc}o\*$qpvc"M>6mwJ5I ='|zH4RL^)MVSaG; 7&# yKZ@u=@0E8'W",A̪&R܉k,X n P?#9Nk1Q;]P.!y9N~S]L(\0ʄ?B3j/J?ujD0ݗ|=*o5?bA_NLFY4xMlL5#˚P c>nv#)b>3}X&N'gR.-(sD~y%8a>qX71tȸHcr*?ʾٛA\ܤ*eYu/A`i߳4"P_v{w)2"Y .>8)(]09&:Xbz-!q~M ]x!trl~>.Ig[}XW;8 Mfu=Pp']X!聯'u<[x<^޶[&#C=H4z.n|T&%%}>ߋL\ЛCTNZs@M ; ĝmP[ʷD}Ve;"ܺn[xqkIhT3Ε"ډuSwξ%RKhD#\]"D{qox1?Pt\~xMKbrWg$